A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@synology.com
Contact: https://www.synology.com/support
Contact: tel:+886-2-2955-4000
Contact: tel:+886-2-2955-1814
Encryption: https://www.synology.com/security/DA33F457.asc
Acknowledgments: https://www.synology.com/security/bounty_program#acknowledgement
Canonical: https://www.synology.com/.well-known/security.txt
Policy: https://www.synology.com/security/bounty_program
Hiring: https://career.synology.com/HQ/
Preferred-Languages: en, zh
Expires: Tue, 30 Jun 2026 23:59:59 +0800
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEBOtFpSEMIYVhDZvXONXuNtoz9FcFAmhI0woACgkQONXuNtoz
9FctzQ//R+SnrrZlj5bCcpocgsn9RQyeK9jVPWz4MvdAMZ+4gBmpzKC/RCEyHCzj
WlAsbS7ERiGSL9s+SarLqTvglwumUTfD3pyJF6bZS1gcYzUh9+7igeezxsn2AiKA
tsQNsaxxvAwryDars/ZMU7meh0xphSAVxMlK7rrmSAtfCNAyuJ1IVSefogyAfftY
vrlpsVO9I+Uz+uzlvG8t/buZ9+kj8gpG6kkTKKMApKuPx2ctFb9bdNlbBGikqFOs
BXmRhaOyNqGiUReFi9E7FUXE+sQ8PqDSBEfNVivEWUZIrBs6Tz9ryUZe5PcdRxTQ
5MmxfPAIZy8PTIuWLgJQq2PHv0tfTuRhA9gdbBJXs78gG/QSGobnteqbJw4AXjfp
rivxAteMhyShhtr/Xn5H/PT8mevY373NN45UPhec3STfXfCw597doTSFWWdeLiUi
XQmdMMee94dmuHKss7xw/JgY5oul3tcDPT2pGE1uYjIPNoxhKEmHkXHfv6KkdRMI
n2VUIOukRybE+73Cx9Bg+aQ5du+s4qc3OgDEJDLPoyWni6s8GcEdCYl4wcXpsyt1
6p1rZIxW647ptA3OTpJNUMsl3wt3NrCIzjTweJ6M7Le9mDvshB58H9Uh8KCmKU5N
TBi5IBcdy6fVdoEAZadGQ3YInTPDxXsTxcMeTg3Kv6/sTPwLlfY=
=KcVF
-----END PGP SIGNATURE-----