A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Contact: https://www.atlassian.com/trust/security/report-a-vulnerability
Contact: mailto:security@atlassian.com
Encryption: https://security-static.prod.atl-paas.net/atlassian-security-public.asc
Preferred-Languages: en
Canonical: https://www.atlassian.com/.well-known/security.txt
Policy: https://www.atlassian.com/trust/security/report-a-vulnerability
Hiring: https://www.atlassian.com/company/careers/all-jobs?team=Security
-----BEGIN PGP SIGNATURE-----

iQJLBAEBCAA1FiEEXh3qw5vbMx/VSutRJCCXorxSdqAFAl5PSvoXHHNlY3VyaXR5
QGF0bGFzc2lhbi5jb20ACgkQJCCXorxSdqDkgQ//ZNpY4XBxQPVGSqpUgDVdknZh
CJupdpSV0WK0LgsXBQfFFp+6Rcb8m/2YaYVxh/F0XGu8rX9lqm46FVX2gJAC7hW0
Rgyl6KFoqbj3PeHsAHPzRussRo315jWcTe/6T1uKXEV9nt+0xFwORiielZVL4jfv
O107gykCQr7Z7FOrdk3+dHOviOw8M8fdkx5uctKy/gwMddnKdYYWRB4NcbvmZjjO
ShGXn8SU528fB575N/ElBGL1pn8a7zJ4m0ucOeAoVkuoIp2VsgaUxXzDnSm9c2FC
fhTe4LG4gn/LaiXWAGMLa1KMZFB7kGp8JPD4jfQN8zI40I6ZKzZvRk6ktXpymEXP
vpD/5oskmB5tjow+9eEzINhUxHfltlI8VVVAI22+oNUTR6Pmx7u9opVnHdyxB+ew
+Gf8NhUeNEjs9zL5dZXX+RoHDfzLBwVx8f2rDXRdwo+VkkETRXibTdVKqx+o2sAY
sPuD4vAYD2InpfbTuMkEe9/N2Y6te3kgyt6I8ps7kDIlzN4syvgi2ml54BRt4OcO
5jjdcolepLwLHJRicvXTJ9tDkHA6D59cHbqwmcxjrwsys7Txsod6GHIASJ3fhLFa
ZfIP+q2WrkKwyjpsybwb2zHcscd2mV5S3w8q7UPPEOkhF199+FnF0XjCkfa9tZtj
bXR9DfC0pEpqVwaDtV4=
=OUdQ
-----END PGP SIGNATURE-----