A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

# Our security address
Contact: mailto:security@hzeeland.nl

# Our OpenPGP key
Encryption: openpgp4fpr:7D55B928638ACF176A412477A0F667BCDC899C3F

# Our security policy
Policy: https://hz.nl/uploads/documents/1.4-Over-de-HZ/1.4.3.-Regelingen-en-documenten/NL/6.-Overige-regelingen/Overig/rfc2350-hz-csirt-20160610.txt

# Our preferred languages
Preferred-Languages: nl, en

# Location of this security.txt file
Canonical: https://hz.nl/.well-known/security.txt

Expires: 2025-12-06T11:00:00z
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJnUtZZAAoJEKD2Z7zciZw/L0UIAJ6CRaqwtRnFdsluYtX+UTsS
pjAoFykYIy/GjK5W41hK9CPn4MXGobbhbU2jnCiz7+3Bl/QHKvr90Nuh7Rx61m5k
DhvHNRX+UFpy0tUTz0jpxuoOl14vOhVRB7F3mSSSWbqiPtYXyahWKFflm8vYOdZ9
QzFe3MKABOCzM0p8BwsZXovvUTTSu7udr9RU0A5SEh1oHbaCq5RGW59tfLGlCrtN
Ygl9OKNlb4EeVnzLwY11N8cMNVwlNMydtp/9aGGMijgLBt58s3MGKsOzLLjmAqK/
rkoPh/HK0WJplUzJLVTquyZZMTp3ZIuxdfgxr4318RhAwjHrq+IN0IFmm6V7dRA=
=4ziX
-----END PGP SIGNATURE-----