A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# You can reach us through email
Contact: mailto:security@circleci.com
Preferred-Languages: en

Expires: 2026-06-01T09:00:00.000Z
Encryption: https://circleci.com/.well-known/pgp-key.txt

# For more information head over here
Policy: https://circleci.com/security

# Jobs!
Hiring: https://circleci.com/careers/jobs/

Canonical: https://circleci.com/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEPNKkjyBxYcC5txriYXAVuEAT3acFAmfAtksACgkQYXAVuEAT
3ad7IAf/fxZFN2/cctoK+TowehCdSxAOQMQP/AZSBsbLESV0KP/glLTHGnbXE9OI
tBywpJrZxaYZ+iE0cf9sLMYHNY0Bgog5n0SYOiyeWU9r8+EKjMKLpwP/Mvj8BtgS
sbw7yD1Jw8jHZHwsoi9pUjo0ezF6L39aO+SFFSiZO+g90tgHXAvlcEFiOO2PbLH0
Afs0dCpuVd0JltNIltgAKdtp/Igkiwayx2m4QBXEmlPe1AUELvdYRMbIeSzEUztf
xpP5mkE+pt22MmoUkpkTgV3GTb3gF/ffKqAk9BMT3qj7pcURyv28smiOlBagtd0k
GyOm9ngs2FZ/8JZpSktRN+mcCIShUA==
=y2uN
-----END PGP SIGNATURE-----