# Responsible disclosure contact, per RFC 9116.
#
# Required before the Phase 1 public launch (SECURITY.md §10). A researcher who
# finds a flaw should never have to guess where to send it — the alternative to a
# published address is disclosure by tweet.
#
# Two contacts, in preference order, and the second one is the point. RFC 9116
# reads multiple Contact fields as most-preferred first, so security@snagspy.com
# is what a researcher uses — and the personal address behind it is what catches
# a report if the alias is not forwarding yet, or stops forwarding later. An
# address that bounces tells a researcher the project is abandoned, and the next
# thing they do is publish; the fallback is what makes that impossible with one
# misconfigured DNS record.
#
# This file shipped for months with an RFC 2606 documentation host in the Contact
# field and no build ever objected, which is why internal/securitytxt_test.go
# exists — and why this comment cannot name the host it is describing.
#
# Canonical names the apex rather than a subdomain because that is where this
# file is actually served: one Nuxt app serves the landing page and the dashboard
# under /app, so web/public/.well-known/security.txt is published at
# snagspy.com. It must not be added before that is true — a Canonical naming a
# host we do not serve is an invitation to serve a different file there, which is
# the one failure mode this file exists to prevent.
#
# Policy is still deliberately absent. It is optional in RFC 9116 and there is no
# policy page yet; pointing it at a 404 would be worse than omitting it, and the
# terms below are the policy until there is somewhere to put them.

Contact: mailto:security@snagspy.com
Contact: mailto:rellinxe@gmail.com
Canonical: https://snagspy.com/.well-known/security.txt
Expires: 2027-08-01T00:00:00.000Z
Preferred-Languages: en

# We do not currently run a paid bounty programme, and saying so plainly is
# fairer than leaving it to be inferred. Reports are acknowledged within three
# working days, and we will not pursue legal action against research conducted in
# good faith against our own systems.
#
# Please do not test against another tenant's data. Ask for an account instead —
# cross-tenant isolation is the property we most want tested, and we would rather
# hand you a second organisation to attack than have you use somebody's real one.