A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Canonical: https://normative.io/.well-known/security.txt
Contact: mailto:security@normative.io
Expires: 2025-06-27T22:00:00.000Z
Encryption: https://normative.io/security-at-normative-pub-key.txt
Preferred-Languages: en
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE9AHgwgBMvGWfx+h6yJ82DpWuKd0FAmZ78/QACgkQyJ82DpWu
Kd12WA//dUBrTNMJKyIDGEeGFQlKCpWHzHjSaCw4eLFOr2bBdM0+3fvrxMGsUIAL
JLdw3qLCR/BhGa8utN+TqVDX0bg8uq2FgoUeX9MezxMR/ym6EHaZEVXCtmTamqB4
dsc/yNIqsrcBoZX2HawiGaHDmomOzXzH2UBjeRWJYMz++y1HNT6LF6MsvT64+e5/
hzRvb/1vN177fHJutSOX7WSqnmPzcihwu44RdozXUEJz3LT1f9C1X0LyUq12W6eJ
wql9lGWS53tjCLpnYGCynjb9alApwkiQUSDMQoGahMtDfUy0fhPR7ZOGtnd5LKhn
yE9pTrC3GbIMFn5fHTSUrhtudusqCBAaKrNTFCzF948L6FT0/u+h3kHoQ3g+Lyb3
pb7apE1IOwFBy7yFcBNzUmFPpCov8CSS8pS2ndDtXuVP5mv+tuZuDuY6awuGj5oI
w/u8L6fiAixY3jhm2Pzjkli1DospjCBG7MSDFHj7oZBz3cM0OBdLULYMteatix1q
sxsK4oXmtvJ7r5VJasozvLWFFf+KLW+h83zFdFUH7V+46Dgx4BigCMUlIFDIzr+N
t1LWFrFjHSygVpSaEKQK+ZXQiOweqAM5WhrsAAef+4AUv/2CBUxs4zw+CEYW03jY
62meChfnKxY5kdaiBgJN/U6AZLuy6bpu3GjJJCSd+gylFlu8Whk=
=urVi
-----END PGP SIGNATURE-----