A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Our security address
Contact: mailto:security.disclosures@trooli.com

# The expiry date of this file
Expires: 2023-01-01T00:00:00.000Z

# Our OpenPGP key
Encryption: https://trooli.com/pgp-key.txt

# Preferred language for a disclosure
Preferred-Languages: en

# Canonical URL
Canonical: https://trooli.com/.well-known/security.txt
Canonical: https://trooli.com/security.txt

# Looking to join us?
Hiring: mailto:security.careers@trooli.com
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEiwfXI18UdPbE5yD9sr8XPiknZGcFAmHdzoYACgkQsr8XPikn
ZGeL2hAAn8AK4GFjY4X/mV7Fc+1b1NysSQvjRwhK3Qm8lDdggqMYFjeNWagRA4bK
in8PH9pZHPAbGRAMbUvrny7B2PL46QU+idzVAS7TwZcdVCN8eVP6eKF5E2WvXVMJ
jJUYaNHZGaXdGUPTjdIX7ru5oYFhyAQbtvpiJyRV4ghCF4iHWH9R98KNUAeVdOrc
nGIvo0BBLuWyc9IvvdloMHtW41rwd3owmuwHtfUV0bDwn203dNhyoyvQN6esdiw1
yX7tmCSX60hXyhlbBGwfiZZjmLQh2Zd610octxddNAIjZIfUDA92/sDwQfOlIDOy
ZydyPkHhm+wAlahpHLkV9Eme0qJzH177Lj5izQmSjlyD5SSWEYUfD7wyl9ROgrxc
uMhDMzjVTYTl0Ctv9ajTf5bCTakcKn8c9ghSp53YvByrwLmvRsLJDOA5c7sRDl49
HfA1SZQez6MSnyiDfW8f053cNpm4SX8X1B1KA1s6HCs0Cp79RYaRTGnMZ6ovodFy
XBHe3Pd/jXwxcijqjfTsBVTZ2pKyOT1OMgnpFAIb/2Kd4d4vWFAvTOU54wrf6kJm
EfYd4LoDIePE32zWbsgo/fQYaKJX89EwyHdGffscq/1KUn+NymKcDct76cN/GgVT
AZln70CMiqiOrhFJ0OP6fLEpnU4Lro4GYqtWN6hKNECi+1zOCAc=
=AFFV
-----END PGP SIGNATURE-----