# Bidda Intelligence (PTY) LTD - Security Contact (RFC 9116)
# CIPC 2026/363776/07 - Cape Town, South Africa
# https://bidda.com

Contact: mailto:security@bidda.com
Contact: mailto:info@bidda.com
Expires: 2027-05-13T00:00:00.000Z
Preferred-Languages: en
Canonical: https://bidda.com/.well-known/security.txt
Policy: https://bidda.com/security

# Scope
# In scope:  *.bidda.com (web, MCP server, /scan endpoint, /api/v1/*, edge API gateway)
# Out of scope: third-party services Bidda depends on (payment processors, identity
#               providers, form and email providers, and CI infrastructure).
# Please report issues in those services directly to the relevant vendor.

# Acknowledgements - Friends of Bidda
# We do not currently run a paid bug bounty. We do publicly recognise
# researchers who report valid issues in good faith. With your permission,
# you will be listed in the "Friends of Bidda" hall on https://bidda.com/security
# with your name (or handle), optional organisation, and a link to a URL of
# your choice (personal site, GitHub, employer, lab, social profile).
# Recognition is at our discretion and proportional to the impact of the finding.

# Safe Harbor
# We will not pursue legal action against researchers who:
#   - act in good faith,
#   - avoid privacy violations, data destruction, and service disruption,
#   - give us a reasonable window (30 days minimum) to remediate before public disclosure,
#   - do not access or download more data than necessary to demonstrate the issue,
#   - and stay within the in-scope assets listed above.