# Security contact for orrsubmit.com — RFC 9116
#
# If you have found a vulnerability in ORRSubmit, please report it to the
# address below. We would rather hear about it from you than from someone else.

Contact: mailto:security@orrsubmit.com

# REQUIRED. An expired security.txt is treated as invalid by tooling and by
# most researchers, so this needs renewing before the date below. Put a
# calendar reminder somewhere you will actually see it.
Expires: 2027-07-01T00:00:00.000Z

Preferred-Languages: en

Canonical: https://orrsubmit.com/.well-known/security.txt

# Optional fields deliberately omitted rather than filled in with something
# untrue:
#   Policy:          add once a written disclosure policy exists at a real URL
#   Encryption:      add if you publish a PGP key
#   Acknowledgments: add if you start a credits page
#
# No response-time commitment appears here on purpose. Publishing an SLA you
# have not agreed to is worse than publishing none.