A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Expires: 2023-12-31T23:59:59.00Z

Contact: https://yeswehack.com/programs/dovecot
Contact: mailto:security@dovecot.org

Preferred-Languages: en, de, fi

Canonical: https://dovecot.org/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEK+dKqz7nVN+5yA0zGKNIru1AnaEFAmOrL7YACgkQGKNIru1A
naEymA//XfwtvXp9gBlEGfTfXDz98HZi8urAT+8UHwCksR3rLBrvZSaMDMj4hzZj
2S2JZH5N/saO77N1MvQyQK0Bns73yweT+Mq1j76+1CSGdm/2rUEVSDKqs017cAmb
Xds1z4I9wExkuWrm5id6y3+a7ss6o8jkJPFLKlmezVl0+W1MvIhc7Vv9EVOckUvR
ZoPkW34ydSITTK6+4iYJYWFojtEFeJYSVwNu3unBnVzrqnebFc55+8tdxeSODqpP
5TktASKeXxLzNxyk+rqzssXElUoUbZ5XJjj5WCM8lpLJa4VqLBde85celrOi6iie
U6N/GMqW5hL46xVN0d/eQ9VVctmFOHzkHR6uLI5uqjRMHSNygTE4kBXYD5oxTyg6
PbRWJOLhgY/DGmkoAovjC7qqoOyCP2ggmaaGFn5VII19KwAPF+dYcRAW/VmKYKUT
KeCUk20k5uMHUdKgwvLFASx+EJHoU7zutWw3pCuzPujfdas9QPbosp0lGNmu/rZ4
rql9PDTeHrBlewW8+/jWWwCHLGLWq+mujyMnzjupo5kiTnb3ZWUVZ/WcvwdnaAMp
CpZMG0iibcStJILmsARhd9pYTSUyy9PSY6rLIXZJXBgBgCwXqsddmR3kbbFlaox7
Po543BqJKpGPL1oIpaxYT3g9vDKI5VxKda5w3SeJ1DtdGdhQwTk=
=nL3r
-----END PGP SIGNATURE-----