# Blopus security contact (RFC 9116)
# If you have found a vulnerability, please tell us before disclosing it publicly.
# We will acknowledge within 3 business days.

Contact: mailto:support@blopus.ai
Expires: 2027-08-18T00:00:00.000Z
Preferred-Languages: en, pt
Canonical: https://blopus.ai/.well-known/security.txt

# In scope: blopus.ai, api.blopus.ai, mcp.blopus.ai, and the published SDKs
#   (PyPI blopus, npm blopus, langchain-blopus, llama-index-tools-blopus,
#    @blopus-ai/openclaw-plugin).
#
# Please do NOT run automated scanners against api.blopus.ai. It is a metered API:
# scan traffic consumes a real account quota and looks identical to abuse. Test against
# your own key, tell us first, and we will not count it against you.
#
# Out of scope: reports generated solely by a scanner with no demonstrated impact,
# missing headers with no exploit path, and rate-limit findings on unauthenticated
# endpoints.