A Vulnerability Disclosure Policy for a Solo SaaS

Before any pen test or SOC 2 conversation, a product needs a way for researchers to report bugs. Here's the security.txt, PGP, and rotation setup we shipped.