# mosADD — security contact (RFC 9116)
#
# Why this file exists: /.well-known/security.txt used to return the SPA shell, i.e. a
# 200 with a page of HTML. A researcher — or a scanner — looking for where to report a
# vulnerability got a marketing page instead of an address. The address itself was never
# secret: it is printed on /trust, on /help and in six FAQ answers. It just was not where
# every automated tool looks first.
#
# ⛔ Expires is NOT decoration. RFC 9116 says a file past its Expires date MUST be treated
# as stale, so this one silently stops counting on the date below. Re-date it (and re-check
# that the mailbox is still read) at least once a year.

Contact: mailto:security@mosadd.com
Expires: 2027-09-20T00:00:00.000Z
Preferred-Languages: en, pl
Canonical: https://mosadd.com/.well-known/security.txt
Policy: https://mosadd.com/trust

# What we ask: report before you disclose publicly. We acknowledge, investigate, and credit
# you if you want the credit.
#
# What we do NOT claim: mosADD holds no SOC 2, ISO 27001 or HIPAA certification and has not
# completed an independent third-party security audit. That is stated on /trust and it is
# stated here, because a security contact that oversells its own posture is worse than none.
#
# Source under scrutiny: https://github.com/Hei33enberg/mosADD-OS (Apache-2.0)