# Operelio vulnerability disclosure contact (RFC 9116).
#
# Expires is required by the spec, and a stale file is worse than no file:
# past that date these contact details "should not be used". The check in
# apps/web/lib/security-txt.test.ts fails 30 days before the date below, so
# the renewal surfaces in CI rather than being discovered by a researcher.
#
# Our disclosure targets (acknowledge within 24 hours, assess severity
# within 48, begin remediation within five business days) are the Policy
# link below. They are targets, not guarantees — the Policy page words them
# the same way, and the two must stay in step.

Contact: mailto:security@operelio.com
Expires: 2027-08-03T00:00:00.000Z
Preferred-Languages: en
Canonical: https://operelio.com/.well-known/security.txt
Policy: https://operelio.com/security#reporting