# Dispatch — security contact, per RFC 9116.
#
# TODO(owner): two things before this ships.
#   1. Add a Contact: mailto: line once LEGAL.contact.security in src/lib/site.ts
#      is a real monitored mailbox. The page URL below is a valid Contact under
#      RFC 9116 section 2.5.3 and works on its own — but a researcher at 2am
#      wants an address, not a page.
#   2. Refresh Expires before it passes. It is deliberately one year out rather
#      than ten: a stale file is a signal that nobody is reading the mailbox.
#      The same date lives in LEGAL.securityTxtExpires; keep the two in step.
#
# Canonical matches `site` in astro.config.mjs. If the domain ever moves, both
# change together — a Canonical pointing somewhere this file is not served from
# entitles a reader to ignore the whole thing.

Contact: https://nogenic.com/legal/security
Expires: 2027-07-29T00:00:00.000Z
Policy: https://nogenic.com/legal/security
Canonical: https://nogenic.com/.well-known/security.txt
Preferred-Languages: en

# No bug bounty. Reports are answered inside 3 working days, assessed inside 10,
# and credited in the release notes if you want it. The policy page lists what is
# in scope, the safe-harbour rules, and the weaknesses already known and
# documented — read that before spending an evening on one of them.