# GC Prep Vulnerability Disclosure Policy
# https://gcprep.app/.well-known/security.txt
# Spec: RFC 9116 (https://datatracker.ietf.org/doc/html/rfc9116)
#
# We welcome reports of security vulnerabilities from researchers
# acting in good faith. Please send your findings to the contact
# below. We aim to acknowledge within 48 hours.
#
# Scope: gcprep.app and all subdomains, including the GC Prep
# Android TWA app (app.gcprep.android) when listed.
#
# Out of scope: third-party services we use (report directly to them):
#   Supabase    — security@supabase.com
#   Stripe      — security@stripe.com
#   Sentry      — security@sentry.io
#   Netlify     — security@netlify.com
#   Resend      — security@resend.com
#   Cloudflare  — security@cloudflare.com (DNS / CDN layer)

Contact: mailto:security@gcprep.app
Contact: mailto:support@masonbyte.com
Expires: 2027-05-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://gcprep.app/.well-known/security.txt
Policy: https://gcprep.app/security-policy.html

# Acknowledgments page (optional, populated as researchers report):
# Acknowledgments: https://gcprep.app/security-acknowledgments.html

# What to include in a report:
#   - Description of the vulnerability + impact
#   - Steps to reproduce (proof of concept welcome but not required)
#   - Your name / handle for acknowledgment (optional)
#
# What we ask:
#   - Give us reasonable time to fix before public disclosure
#     (default: 90 days, negotiable for severe issues)
#   - Don't access user data beyond what's needed to demonstrate the issue
#   - Don't perform DoS / DDoS testing or automated scanning that
#     impacts availability
#   - Don't social-engineer staff or customers
#
# What we provide:
#   - Acknowledgment of valid reports + disclosure credit (if desired)
#   - Status updates during remediation
#   - Notification when the fix ships
#
# MasonByte LLC — SDVOSB — CAGE 7BAJ0 — UEI ZERAMJ6UEML9
# Accokeek, MD