A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security.reports@clabs.co
Expires: 2025-12-31T21:59:00.000Z
Encryption: https://keys.openpgp.org/search?q=D2174A7CD2BB4846
Preferred-Languages: en
Canonical: https://celo.org/.well-known/security.txt
Policy: https://app.intigriti.com/programs/clabs/clabs/detail
Hiring: https://celo.org/careers
-----BEGIN PGP SIGNATURE-----

iQJNBAEBCAA3FiEExX+opoPIhXG1qrKY0hdKfNK7SEYFAmQYd70ZHHNlY3VyaXR5
LnJlcG9ydEBjbGFicy5jbwAKCRDSF0p80rtIRt3HD/9KSjUu9rpqA9SY0EHPRWoJ
wtBEm8o0GPIQdnd/nfG73k59OZXw/1xUXPB6GIOWSbBaEvwDy9yg5CcG9mdF+GfR
6eDmYHwXIUZuWONH2afkzbGuZ8MuIhkWUfavruj/jJShn4lztO3oT1so04zKWLL7
p0h+xOtjGWO54Y/JIKW9YHxwD7wDbhLPK1lB9WWrPRbLvyzTm/jaD9omluzlRTQW
ycEP7UukPoraKUdgj2LK4ONQh4w4GcIbGgGHFYulN1qUqmgZweIA7Ys6GrIoQCzj
zimj3pV0K0uZpfc9/1Eir015CSxrBF9CiJ/dD7vpDeI9NvSRRjoSRZrbGO7NQLQj
A7eVfesrxRKAHrJeCd8xLAf4Dv4DjSO0kylXWjvBImLwK6t9FAVSpefUXPxrN1qf
UjHwwb+ZCf/cCX8YoDgMlyfhtc/bWg+2HBPHI2iFVMIorsLrz/CCt90qJZjqMGZO
5DYOIHSWSlO8DFGjISW3kMlOghoOwwe34mzoK0RRvcxZDX+SOdTvkMQNjXVZyX0C
usPGkSC9fDemsAa9cjFlQmZBENStpyHZWLMa/7ya+t4+JM4LWxzrfrik28TWtBkW
/75n2vsmTWDiCVn3Dz5v/u5WMhmyjGzm4khJGckBlq9r06SRIbtAIaPjMDe6KPlm
ic2JL7oIFaULGcW6YF+OCQ==
=r/Bd
-----END PGP SIGNATURE-----