# Veync vulnerability disclosure contact (RFC 9116).
#
# This file is HAND-AUTHORED and repeats the production domain as literal text,
# because a static export cannot interpolate a build-time value into a file in
# public/. The README pre-launch checklist lists it alongside _headers,
# _redirects and vercel.json under "update the domain in these files too".
#
# It is deliberately NOT PGP-signed. Signing requires a published key, and key
# generation and custody are out of scope for the site build — the disclosure
# page says the current public key is available on request from the security
# mailbox, and no fingerprint is published. An unsigned security.txt is
# valid under RFC 9116; a signature over a key nobody controls would be worse
# than none. For the same reason no encryption-key field is declared below.
#
# Expires is a committed date and a maintenance obligation: it is carried in
# src/content/placeholders.ts as a date-to-refresh entry so the annual review
# is not left to memory.

Contact: mailto:security@veync.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en, fr
Canonical: https://veync.com/.well-known/security.txt
Policy: https://veync.com/en/security/disclosure/
Policy: https://veync.com/fr/security/disclosure/