# RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116) security-contact manifest.
# Served at https://<host>/.well-known/security.txt — the address security
# researchers open first when they find a vulnerability. No file = reports
# scatter to Twitter/GitHub issues and coordinated disclosure goes out the window.
#
# Maintenance: rotate the `Expires` line at least 12 months ahead of its
# current value. Past the expiry date, researchers treat this file as
# abandoned and the reporting funnel goes silent. Full rotation + deploy
# checklist: docs/guides/security-disclosure.md
#
# Field purpose:
#   Contact             — monitored inbox for reports. Only mandatory field per the RFC.
#   Expires             — abandon-date (mandatory per RFC). Bumped yearly.
#   Preferred-Languages — languages we commit to answering in.
#   Canonical           — URL-of-self. Prevents a malicious mirror claiming
#                         to be our channel by serving a different file.
#   Policy              — public page with scope, SLA, safe-harbour clause.
#   Acknowledgments     — public hall-of-fame for prior reporters (opt-in on
#                         each researcher's side).
#
# Production swap: all hostnames below must match the real prod domain on
# first prod deploy. A mismatch between `Canonical:` and the actual serving
# host breaks the anti-impersonation check researchers rely on.

Contact: mailto:security@zoctus.com
Expires: 2027-04-22T00:00:00.000Z
Preferred-Languages: en, pt
Canonical: https://zoctus.com/.well-known/security.txt
Policy: https://zoctus.com/home/security
Acknowledgments: https://zoctus.com/home/security