A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


# ,--------     ,-----.     ,-----.          ,------.     --------     .--------
# |         \   |     |     |     |          |      |    |        \   /        |
# |          \  |     |     |     |          |      |    |         \ /         |
# |           \.|     |     |     |          |      |     \___      x      ___/
# |      |\    \|     |     |     |          |      |     ,----     .     ----.
# |      | \          |     |     .------,   |      |    |        /   \        |
# |      |   \        |     |            |   |      |    |       /     \       |
# |______,     \______,     |____________,   |______,    |______/       \______|

# NL-ix Security Vulnerability Disclosure File (RFC9116)

Contact: mailto:cert@nl-ix.net
Expires: 2025-07-30T22:00:00.000Z
Preferred-Languages: en, nl
Policy: https://www.nl-ix.net/about/privacy-security/
Canonical: https://nl-ix.net/.well-known/security.txt
Encryption: https://nl-ix.net/extras/cert_public.key.asc

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRFpD5c3Vq+USfU+Gck6fjIOqpWrwUCY2vi1QAKCRAk6fjIOqpW
r5JUAQDE1huDz8Kg0SjM2JcVuHrAkk7BR/juYJ+BeW5sFvFIqQEA+AsA0weVBebh
MKNBYuHesYnRXLcEcTZhcuCYBklpgQ8=
=FBNP
-----END PGP SIGNATURE-----