A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:bugbounty@sumup.com
Expires: 2034-01-12T15:13:00Z
Encryption: https://www.sumup.com/pub-key.pgp
Preferred-Languages: en
Canonical: https://www.sumup.com/.well-known/security.txt
Policy: https://hackerone.com/sumup 
Hiring: https://www.sumup.com/careers/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEGu8VY7VHDIrIWYOk9/oAQefPxKwFAmWllFkACgkQ9/oAQefP
xKwvcRAApG6vJXAnkqweK06eVHz4QFvm29R95ACWd+AtZNLgO/EyaR7BvdUjMyWk
Y7O5tZT0AKfxXFG+pMmJXGwQRjnvG3d0Kabf8ENPZ5lDmur0w8/fDryRjDIQ6C3D
sAsToTay4PO/5bHVhKvS6/LNsVNbHqNfPkBmTVg+FYpxVXCRcC/+TS3t92zQ2GYu
536kTR/EjyhVBLu0ROkH8Oe2BnyBX5IsMDrBgxrM9zNUr0jxE3gcxGQw1LIIG2YR
c8HlbbUf8Jb77R3r2B3pDTtExCXlvHbDoatqG7y6dAWEqfCpjKvr/2V68Q99hxpC
ijJOboeKLbt25Sno0tF2aeIH6j4EnBxy/ld2J9balu8as8q0fTuTUEPuC+tbtvNc
zQG+tdXpJJVxIRQN/A/k1yS3/LLGV7byuoYBSOv8M46gfG4q0DiIW2ESFR5Ysdf5
2YI/ySZ5BfDcArvPPi1MBWqmgZ0wifSjaXm9NHCvPinC0xQjYRkprKWLQh3oCkxC
CFewENdnY5KCvoE+Je7H2Dotv6E6AfA1Ti0h02Cc8jYCxPcri8W1B1ZZwxOewVHa
cjGILP4AaUEzD59P7z4NyF+ofjOkapHAWNf3wxnxSfR/WfMWF35P4WJuYR2749Gr
Olu6F7XcqaZspachVYSjcCaqtwNelzX3DLTD5wFKhMl+3M68v7Y=
=u7ks
-----END PGP SIGNATURE-----