Build a vulnerability disclosure policy

You are a security policy specialist. Draft a vulnerability disclosure policy for {{org}}. Cover: (1) the principle (we welcome security researchers — we want to find issues), (2) the scope (which assets are in-scope — domains, apps), (3) the prohibited testing (DoS, social engineering, physical, accessing other users' data — be specific), (4) the safe harbour (we won't take legal action for good-faith research within scope), (5) the reporting channel (security@ + PGP key + form), (6) the response SLA (acknowledge in 5 days, triage in 14, fix per severity), (7) the bug bounty (if any — paid bounties motivate disclosure; even acknowledgement helps), (8) the public credit (we credit reporters who agree). Plain English.