A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: mailto:security@validao.xyz
Expires: 2039-09-03
Encryption: https://validao.xyz/.well-known/pgp-key.asc
Preferred-Languages: en
Canonical: https://validao.xyz/.well-known/security.txt
-----BEGIN PGP SIGNATURE-----

owGbwMvMwMEoeMc6R/z7QR/GtYxKSTzFqcmlRZkllXolFSWpeebvdUHAydXd008h
2NU5NMgzJFIvJCIELMzlkVicYaUQ7OFoZGrGxeWcn1eSmFxipZCbmJlTkm8FM8oh
sywxJyUzJzGpWK+isorLtaIgsyi12ErByMDYUtcAiIy5XPOSiyoLSjLz86wUMkpK
Coqt9PVRtenrlafm5Ohm5+WX5+kXpBfoZqdW6iUWJ3MFFKWmpRYVpabo+iTmpZcm
poOMTs3jck7My8/LTE7MIcpEZH9zgX3n6ueCxcudjJtZGBg5GGTFFFmSHs1b0rPk
i9vZM1eTYaHIygQKNQYuTgGYyLYV3H843cJT3omwJ11cxeL49P7UqSVV+svC92p/
UPqTdY9tzd9SkYBaHf5kLjfjs827ZY6efP/2WMxhiSgRlfLjCm6Lrmqsn315s2Vo
XaqRzI2O8w9KV1SVbzvSu1p+x+t9q/W6H2cHpInfbKzbLikz5Yn4q4yDn//HTRcL
3qD2WWunsvMSryn+RySD9qz1e69TYvr+n7t55KHe4B/Vd/JyvN2TVnyzt51fIRFx
p+s395YbRr47+W/mf719/KZ/0Juz+6t5DvGEVG4PeZ3ib9zEZ+eywneByH9hx13l
cwoeSm1M3ZYsWyFtJPng9RfJ+PuLj8W/f1vw+Nfr9nyu88J/Vf63CPtw8PxWeyf0
yfq0TSzTq3SxO8e8JlZb5Or/3c0ULdmzkPt7Ykl6sr1Ua3xGqoPYzk28XK+Yp7yS
kjppePas5bkW99P7gxetbr3BMuFu3vZt4jFivKcdph9xL9d6xz99Ru7mDQxZs35r
L5xhLdMU+z9O9Gfb3N2i0lK9STd8f3CZ7l495VXc0dnLe4RaL2RFZjMv3QwA
=pMKv
-----END PGP SIGNATURE-----