# SlyOS — how to report a security problem to us.
# https://datatracker.ietf.org/doc/html/rfc9116
#
# Until this file existed there was no answer to "where do I send this?" — a
# repo-wide search for security@, "responsible disclosure" and "bug bounty"
# returned nothing, and the /security page ended without a contact address. A
# researcher who found something in SlyOS had nowhere to send it, which is a
# worse outcome than any single bug they might have found.
#
# THE ADDRESS BELOW IS THE REAL SUPPORT MAILBOX, not a dedicated security
# alias, because a dedicated alias does not exist yet and publishing one that
# bounces would lose the very reports this file is here to receive. Creating
# security@slyos.world and pointing it at the same person is a five-minute
# change and is listed in docs/OWNER_TODO.md; when it exists, change the
# Contact line here and nothing else.

Contact: mailto:support@belto.world
Expires: 2027-09-22T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://slyos.world/.well-known/security.txt
Policy: https://slyos.world/security

# We are a small company and there is no bug bounty. What we can promise is
# that a report to the address above reaches a person, and that we will tell
# you what we did about it.