# Security contact information for podee.app, per RFC 9116.
# If you have found a vulnerability, please tell us before disclosing it publicly.
# We will acknowledge your report within 2 working days and will not pursue
# researchers who act in good faith within the scope described in our policy.

Contact: mailto:security@podee.app
Expires: 2027-08-01T23:59:59.000Z
Preferred-Languages: en
Canonical: https://podee.app/.well-known/security.txt
Policy: https://podee.app/legal/acceptable-use#security-testing

# In scope: podee.app and its API.
# Out of scope: the Tesla Fleet API and Tesla's own systems — report those to Tesla.
# Please do not run denial-of-service tests, and do not access, modify or retain
# data belonging to anyone other than yourself.

# TODO before launch:
#   - Confirm security@podee.app is monitored.
#   - Optionally add an Encryption: line pointing at a PGP key.
#   - Diarise renewing Expires above; an expired file is treated as invalid.