Contact: /api/suggest
Preferred-Languages: en
Policy: /privacy.html
Expires: 2027-07-23T00:00:00.000Z
# BuddyLists pre-launch. Security invariants are published in /manifest.json.
# Report vulnerabilities via POST /api/suggest with the prefix "SECURITY:" in the suggestion field.
# No email address is required to file: {"suggestion":"SECURITY: ..."} is a complete filing.
# Filings are recorded in this deployment's runtime log and reviewed by the accountable
# human founder's operations loop on every cycle. As of 2026-08-05 no outbound delivery
# path is configured, so a filing is read where it lands and is not emailed onward.
# Responsible disclosure earns launch-day fee credits.