# AskDocs — security contact
# Format: RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)
#
# Please do NOT open a public issue for a security problem. Report it
# privately first so there is time to ship a fix before it is public.
# We aim to acknowledge a report within 7 days.

Contact: mailto:info@idefender.io
Preferred-Languages: en

# PLACEHOLDER: the two absolute URLs below need the final public domain,
# which is the same decision that gates the canonical tags in Task 5.
# Replace TODO-REPLACE-WITH-DOMAIN in both places before launch.
Policy: https://TODO-REPLACE-WITH-DOMAIN/self-hosting#security
Canonical: https://TODO-REPLACE-WITH-DOMAIN/.well-known/security.txt

# RFC 9116 requires this field, and requires it to be under two years out.
# Refresh it on every review; an expired security.txt reads as an abandoned
# project to exactly the people who check for one.
Expires: 2027-08-26T00:00:00.000Z