A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Contact: mailto:security@netatmo.com
Expires: 2025-07-06T12:47:00.000Z
Encryption: https://www.netatmo.com/.well-known/security-pgpkey.txt
Preferred-Languages: en, fr
Canonical: https://www.netatmo.com/.well-known/security.txt
Policy: https://www.netatmo.com/security-incidents
-----BEGIN PGP SIGNATURE-----
iQFJBAEBCAAzFiEE3BB8DLxJ+F0imqSKYy6RathHkgIFAmSm2tkVHHNlY3VyaXR5
QG5ldGF0bW8uY29tAAoJEGMukWrYR5ICClQIAL8t44GLGgRCwpfs2cOZMfqaZQjJ
rfI/rd02kpN2gjXS+eB6QhHpCBfphUvGrNC0zHXhiztQeRI/thlWEdIbR1Zea+E7
p4sOQAeqmSwIacE6JNtsmN+FK/PLt4KGGkdCEL88YmSubvUxXCqapgcBBf8feUGl
98DZvSINt/VXryE+am3U/dyfEgToESHX9Jv06sYHI5wT6oDse5dTAbfv0SV49+Ky
ZPkRLfVkQ+8F6FmFePmQhKm2Zw9gjoeIqne4zOk5cs7z7wFMaOXqbmzxKFF7j8cH
WqMYSlvB8sY7aRpV4axfnSwjNfD66jdph9YqBJeEoncWcF6Fm7TRNl45TEE=
=JMaQ
-----END PGP SIGNATURE-----