Contact: mailto:security@startos.io
Contact: https://startos.io/trust#reporting-a-vulnerability
Expires: 2027-05-12T00:00:00Z
Preferred-Languages: en
Canonical: https://startos.io/.well-known/security.txt
Policy: https://startos.io/trust
Acknowledgments: https://startos.io/trust

# StartOS security disclosure policy.
#
# Found a vulnerability in StartOS? Email security@startos.io. We will:
#   - Acknowledge receipt within 2 business days
#   - Share an initial assessment within 5 business days
#   - Keep you updated until the issue is resolved
#   - With your permission, publicly acknowledge your contribution
#
# Please do NOT:
#   - Access data that isn't yours
#   - Perform DoS testing without prior coordination
#   - Publish details before we've remediated
#
# Full policy: https://startos.io/trust