# Supero — security contact and disclosure policy
# https://www.supero.dev/.well-known/security.txt   (RFC 9116)
#
# If you have found a vulnerability in Supero or in an application generated by
# it, write to the address below. We would rather hear it from you than from a
# customer. Reporting in good faith is never held against you.

Contact: mailto:security@supero.dev
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://www.supero.dev/.well-known/security.txt
Policy: https://www.supero.dev/security/

# Scope
#   In scope     supero.dev, app.supero.dev, api.supero.dev, docs.supero.dev,
#                and any project you created yourself on the platform.
#   Out of scope other customers' projects and data, denial of service, volumetric
#                or automated scanning, social engineering, physical access.
#
# Please do not pull on anything that reaches beyond your own project. If you
# find yourself somewhere that is not yours, stop and tell us — that is the
# finding, and we will thank you properly for it.