A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Contact: https://support.first.org
Expires: 2025-12-31T23:59:59.999Z
Encryption: https://www.first.org/tech.asc
Acknowledgments: https://www.first.org/about/bugs
Preferred-Languages: en
Canonical: https://www.first.org/.well-known/security.txt
Policy: https://www.first.org/about/bugs
Hiring: https://www.first.org/about/jobs
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEdzURSTcimjwhKYkDf4xlZRP2rVcFAmYWrzcACgkQf4xlZRP2
rVejWhAAu2KpIwuUOjFNkZ4urNqvDm0+uwbiiEl5qOV607sqXBjyx5IHC4Sj7A+q
y0fjOIvX3+Q5VWmscK82l4B8cBgO1r9qVaB7HLekykmqZttdAf5027PAvV7LxMIf
ashEWZmPiU0ZONBkL36ipFPEjPfQwp6nrPAg84UawqYp9UPKgishQNaQ7mzrWa/8
hIaMUaWi1xXzuPwIgcaKqo2zxrtTLdR/ukuzmkMZfWaSIDosCWbbQhq42ZkK6k0u
5UIh+jDx6E2m3++H3PTxRZXIdUmhiUgwF87i5YPn89ShLp1vPH0pTt6LasVh8kBb
zWO/iiicCXLiQeCFi44KIRCQcy/KPSWzbLefGnojxapi3y5W5z8DXOaM3dpXTsOd
nrEkjqcJAXUImwoFcDD51QEiBUl8kdUbI/8flLh1KSVAVslfH0foswoGy9Rnb3dY
pTRonXKt3S7YHqFegah14u5lJ8vYiNNMVBUU3y6DGTFFM2c2Hm4n8hR1hnl/dtek
Ik3VjtQI1bKOSpUFRPQ2Miip+kYCPDQuVmgcyqoJSAc1JbO349siw9TaYuBn1/De
pD2RwZkS43BmvCPRgR2XQf/kk7rJ0Uva6Ya30+scRqC0ZY2mWK9wy8cO5rqnyHMK
eYRL1ESQZQjQv/lI41RMc4WXceyCAzf7niEa2d3ePDUVKEB7jQ4=
=UdcO
-----END PGP SIGNATURE-----