# denyfirst — how to report a security problem
#
# RFC 9116. Everything after a # is a comment and is ignored by parsers;
# the machine-readable fields are the unindented lines below.
#
# This file is embedded in the binary and served from /.well-known/
# security.txt only. /security.txt redirects here, because a reporter who
# guesses the old location should not meet a 404.
#
# The Expires date below is the only copy of it. A test in internal/web
# parses this file and fails sixty days before the date passes, so it is
# moved by somebody who has re-read the contacts rather than by a timer.
# An expired security.txt is worse than none: a parser treats it as stale
# and a reporter reads it as abandoned.

Contact: mailto:security@denyfirst.dev
Encryption: https://denyfirst.dev/pgp-key.txt
Expires: 2027-08-01T00:00:00Z
Preferred-Languages: en, az
Canonical: https://denyfirst.dev/.well-known/security.txt
Policy: https://github.com/denyfirst/porch/blob/main/SECURITY.md

# The key's fingerprint is:
#
#   75B7 A18A 8971 5E37 75DB  CA2E A8D9 94D1 221A A045
#
# It expires 2028-08-16. Renew it well before then: this file would
# otherwise point at a key nobody can encrypt to, and the failure appears
# to a reporter rather than to us. denyfirst-watch warns ninety days ahead,
# against a date written in the script that a renewal has to move.
#
# Check it before encrypting anything, and check it somewhere that is not
# this domain. The same fingerprint is in SECURITY.md in the repository on
# GitHub, which is a different account behind different credentials. Whoever
# takes this domain serves their own key beside their own fingerprint, and
# both would look exactly like this one does.
#
#   gpg --fetch-keys https://denyfirst.dev/pgp-key.txt
#   gpg --fingerprint security@denyfirst.dev
#
# The key certifies and encrypts and does nothing else. It is not the key
# that signs releases: that one is an SSH key and points the other way, out
# rather than in.
#
# This file is not signed. A clearsigned security.txt would be verified with
# the key it points at, which answers nothing a forger could not arrange.

# A domain owner asking to be excluded from scanning should write to
# abuse@denyfirst.dev instead. That is an operational request rather than a
# vulnerability report and is answered separately.
# See https://denyfirst.dev/privacy