A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:ad@xput.net
Canonical: https://www.xput.net/.well-known/security.txt
Encryption: https://www.xput.net/.well-known/pgp-site-key.txt
Expires: 2026-03-20T13:29:39.555Z
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE0urgddU4Vu77iOWblLhutBcUO7oFAmfcGEMACgkQlLhutBcU
O7prVQ//RDXlmOKgY0Zsx2XyMokSIcwv/MNjSUdhKntHalSHtox46YItGb+WNqOe
02O5JRsFnjg0TieNqeeFSwXKRDAT5jR1l5t233Q2+5UnrDRZUovn4x212up1i/ey
avMA//jAzhGm3soMEjUIHbhB6yQOJbU9Ba749/boXexUEERrKYGGJUxkKECInxlV
80idzlMjsKQ8MhMpHvOFE0uO7mzPwac81n+hcsLVfRJJws+vmgHu0fSinHi/DFF9
uwJRG/cWgWtg5itXkAnHYdcqAipNiyT7aHXXYLNL5mOVeKX5jjmRx7oD745WDIwj
kPgT/vjm+KJa1hAzF7pQfwWgB/eDCFSOkdF5uMQBw8yEXwgnh6ThSGl+bW845NOi
pGJUC2DwbAivMnkHsMO//GTo/XAmYjwvYWGEg/X9wm5tWzjE3/a4r1GnZmCkoaOH
0epXK8W6rebLKFomZKe+JauplpE8OukgOc8vSHnvGnMIoPz0c6J5+mY2gscYIICb
H6y7Uhmkp05IHyoN1e7oZe3B8g5+UO7T2qVy0u/vrEI0kOX6QhH1xwAx187olykr
HFxKLdg3cHJ75KQqa6QheIEIqPSqQC0o2Sklt6qT9OQMQpsyaHpfvbNpUZY+BJ9K
UDQjFO27Lq2/DC5DTCW97XQW8sa3CpJoAG+Q0piolUgsSTgPLNo=
=UQg/
-----END PGP SIGNATURE-----