A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: https://www.nlnetlabs.nl/security-report/
Expires: 2029-11-30T23:00:00.000Z
Canonical: https://www.nlnetlabs.nl/.well-known/security.txt
Policy: https://www.nlnetlabs.nl/security-report/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJjQCBVAAoJEMwxnH591K0AlB4P/iX6MVcvioqHnaxxXqtE8ZS+
KlS2yioD9rZJffK8KHrJR8gmbpUQW2yxx3eqk16HAbVGve+hJRYunsbzQsZLhdJM
5v1L5K2mKWTNKhjBwsqnDVkI6HYiux6MGelsLP/iYb/8z95rPXx+SYLUKAcQNHFz
ahmUtc04LSlbnilmlQ4yTYX+o4Whl8iEydybDjBYmtwuibUklgiw+QoTWVh9gUlu
sR4VwA4TLGuwBZrV6EGm1nI2vEu8vswdzP0/VqbQH56T/Q1Bfho9INlkXdA7ppU3
H9Qcz9e872T40MDqY72WPgklmLH+iuhq/1PcUyWSlz5S6hgLlFQ0GE6fXN2xj1rP
qaOkJkUNAAZPJgw8/AIsUj5bWrVp6udILEGbSoY0vL5c1m5WwJ2yYCnUBkLluIlw
WG+n3B4SXRGdOFpLXBk7V9p6vZpGN96bOb3rsdtlkZEziLgiPbkWIs1XABJRrsIM
QC1AYQ5mgKwSby0Zos9MFS4GV7xCbIFv2quhEYPX/rAJIWBKmNVxmvA9ivDU2F0O
d32tLD69nS2s5ZgEdveCGMvcXNoijO38Rh2D5z7dQkDwLBwte5ieW+L/gsllAr1i
aeaWQRpUpgZgt9smbOfUeRaIj1YrCIXuYbNN+9DMr4iwggOa4TCDfD9KlvzijIh/
1GdV4Ef4viIdQcxs69AC
=xjUV
-----END PGP SIGNATURE-----