A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256



# Preferred disclosure is via HackerOne

Contact: https://hackerone.com/gitlab/



# Additional disclosure processes are available in our handbook:

Contact: https://about.gitlab.com/security/disclosure/



Policy: https://hackerone.com/gitlab/



Acknowledgments: https://hackerone.com/gitlab/thanks

Acknowledgments: https://about.gitlab.com/security/vulnerability-acknowledgements/



Canonical: https://gitlab.com/.well-known/security.txt



Preferred-Languages: en

Hiring: https://about.gitlab.com/jobs/



Expires: 2024-12-31T00:00:00Z



# This file uses the format described at https://securitytxt.org/

# The signature can be verified with the public key shown at

#    https://about.gitlab.com/security/disclosure/#public-gpg-key

#    ID: 98FA455B9ECCCF0E

#    Fingerprint B9EF E21E 6340 FFC3 4B55  16E3 98FA 455B 9ECC CF0E

#

# GitLab team members, follow the process below to update this file

# and regenerate a correct signature

#   https://about.gitlab.com/security/disclosure/#updating-securitytxt

#

# This content should not be copied to self-managed GitLab instances.

-----BEGIN PGP SIGNATURE-----



iQIzBAEBCAAdFiEEue/iHmNA/8NLVRbjmPpFW57Mzw4FAmVxGbIACgkQmPpFW57M

zw6c/RAAohwiPEWxhbUnTBvXZ0nLzdaiqQe9PK81ZTYKIIJZJ5ahcg17fHKQqTeY

clMpPpjcMAW6sSxjUp5xaskVeduLc87x+WUeUzZ8of1qbdsGXh//iGMJ7n8N0R1j

DSS92gTSNAy/UCDHrlTYPG6veIxIXGy1SZB9cD4yc5XYeqiR3HbzbUq87yfoLjgF

ZFd9h7UFpyIHS3xzbZ14REeXKVah+b8H41fdpv1QCpYiA69R/HoYocDz5pqRPvma

pkx8V2HeSnu/ki13QJfP5eC47vkx8MgTZY4sKYLYQHbIGwGyNIqUy9qGCdMFRIeJ

11/Lcbbn3NgTZwDTzZhwsX9KCPYIS4Xlh7ovtNf8dDcLU3GLoWiyc+9N1h4Pgidj

K91eidVNQ1pSN5qP36wYyKSL8JL4uch81OLB7bnfuK/ECGHmbjQgPomzoYWyWZXv

SNBXjvO9lyiBcH3+KW9R+cLHI6LMkNamtjNJ3r3xxHd49QmmDrAsZuWCYcydqOLx

SliD3RBf93gfONcAQnXCBsCzc519GAfBgy5fz7PHENpY8k669Kc2Mczl9WSlfNeG

aSqpuuBFYi/VL51EfsqkVwivztGagVSx5P98smmPtL+LO9JZ9/ucx/ldNUkweQFF

zi9rzRK5KeyEGumKPsf1smQGwKpvRVKd4zKYox+Shk1K63M5EO0=

=bXx5

-----END PGP SIGNATURE-----