A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Please report security issues related to Firefly III to me ASAP, via the email address below.
# Feel free to encrypt your message using GPG altough it's a pain let's be honest
#
# There are some ground rules, please keep them in mind:
#
# 1. Your security report must be related to Firefly III or the associated tools
# 2. There is no bug bounty program
# 3. Please don't report denial of service attacks on the login form
#

Contact: mailto:james@firefly-iii.org
Expires: 2024-12-31T23:00:00.000Z
Preferred-Languages: en, nl
Policy: https://docs.firefly-iii.org/explanation/support/

#
# Thank you for your time!
#
# Cheers,
# James
#
-----BEGIN PGP SIGNATURE-----

iQJKBAABCAA0FiEEAvQEbEsjbgYJVxYStJoyS36tbYAFAmV37E8WHGphbWVzQGZp
cmVmbHktaWlpLm9yZwAKCRC0mjJLfq1tgFtzD/4lrhVkCi4mRAroSMbz7ZHbLwLi
RAgiaFmnDI48LqkX/jJJTWSy8czl9gkKO9uVJzXwmjVzFg5vJTkRfjvNlTyOpL/l
gB+REFYGadp8ulMCZcBlFgLbyAWtvHKV3UW//G8fzrASAEe+2eiuPQooLmwaKows
X+ty2zZEH282uAiR36otlGR2UpUcYAy0XcAuE7hIxfHA8bsh5uqzAkm74OsynC8E
6vBEi1QzarE+cfoZqBtriWELyownM9Z5a/cIzm47RfBkFUKXaQBL3pYN1kX2TAi5
1//0WLrDiotkIwPmdYiYFmVmaJDjcapcAkDoD/wAv8BxxjPZ900RCTF4jzMTxIu0
t6umbm3SaA/vaINv8ilmMMj6ep49GE8EssHvRBUaGnv7JjHe+XCZrOsk3a5+Z4zQ
Sd9nuryLCX/G3Bz63rU/V1evuCT7ouNEWKUlwtYCqU+6BfumTdbJCPEH/4szxoi2
cPvIw5Y5sA9ue5Wm4RIX7G0DyIRJJf3CB0PJWuujzF548hn60MPBLDw7xSraTQNX
v1GRwTHIOo6e1U47naz9U3Dv3pK2J5aibL4K6pjyZG1bTqfE/0uY0hEXVFuNqAxT
B6LSAcrP4j+bU4oZlWRx99yHv1ComWZzi/JvRKp9Y0aTcWbAeT+oz3PFw8K5lff/
eweJG/H9BuHgDXdYQg==
=Z9Gk
-----END PGP SIGNATURE-----