# Security contact for ausref. Reports reach a person, not a queue.

Contact: mailto:api@3l-groupconsulting.co.za
Expires: 2027-11-02T00:00:00.000Z
Preferred-Languages: en
Canonical: https://ausref.dev/.well-known/security.txt

# IN SCOPE, most valuable first:
#   * obtaining a paid answer without settling payment, or replaying a settlement
#   * reading another caller's data, API key, quota or alert subscription
#   * making us serve a figure that differs from what our cited source says
#   * anything reaching the host, the database, or another brand's data

# NOT A VULNERABILITY:
#   * a paid endpoint answering 402 to an unpaid request. That is x402 working
#     exactly as intended. See https://ausref.dev/llms.txt
#   * the documented free trial: 3 POST /v1/answers/* or /v1/jobs/* calls per IP
#     per day answer 200 without payment. Those carry x-free-trial-remaining and
#     a billing.rail "free_trial" field; the next call that day gets the 402.
#   * the free evaluation country (AU): its series answer 200 to browsers or with
#     ?sample=1 / X-Free-Sample: 1.
#   * a free pre-payment refusal (400 or 422) on a request we cannot answer.
#     We refuse before the paywall on purpose so you are never charged for it.
#   * volumetric denial of service, or raw scanner output with no proven impact

# There is no paid bounty. We will credit you by name if you want that, and we
# will tell you what we changed.