# CovaSyn — Security Disclosure Policy (RFC 9116)
# https://www.rfc-editor.org/rfc/rfc9116
#
# If you have found a security vulnerability that affects CovaSyn (the
# website, the MCP server, the workspace dashboard, or any
# CovaSyn-operated infrastructure), please report it via the contact
# below. We respond to legitimate reports within 5 business days.

Contact: mailto:support@covasyn.com
Contact: mailto:oliver.kraft@covasyn.com
Expires: 2027-05-25T23:59:59Z
Preferred-Languages: en, de
Canonical: https://covasyn.com/.well-known/security.txt
Policy: https://covasyn.com/en/security

# We do not currently run a bug bounty programme; coordinated disclosure
# with credit (Acknowledgments page on covasyn.com) is the form of
# recognition we offer. Please give us a reasonable window to remediate
# before public disclosure.