A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Amsterdam UMC security contact information
Contact: https://www.amsterdamumc.org/en/responsible-disclosure.htm
Policy: https://www.amsterdamumc.org/en/responsible-disclosure.htm
Preferred-Languages: nl,en
Expires: 2025-01-20T23:59:59z
# You can find the PGP signing key from rd-cert@amsterdamumc.nl in our DNS zone.
dns: BC542E4F2F1261F00296E36448321BECAE128B06._openpgpkey.amsterdamumc.nl

-----BEGIN PGP SIGNATURE-----

iI4EARYKADYWIQS8VC5PLxJh8AKW42RIMhvsrhKLBgUCZa5mvhgccmQtY2VydEBh
bXN0ZXJkYW11bWMubmwACgkQSDIb7K4SiwaqzwEAyuyQFwEUCOS46/Chs/xKTC5H
dxlEElocLJDQG8vralMBAKjwSQ+Dp1JJglXicD1c4R9y88PjAXb1eFu1Ct6DuoMK
=jLIb
-----END PGP SIGNATURE-----