# DugganUSA LLC — Security Disclosure Policy
# RFC 9116 compliant. AIPM scoring criterion: security_reporting visibility.

Contact: mailto:security@dugganusa.com
Contact: mailto:patrick@dugganusa.com
Expires: 2027-05-08T23:59:59.000Z
Preferred-Languages: en
Canonical: https://analytics.dugganusa.com/.well-known/security.txt
Policy: https://www.dugganusa.com/post/dugganusa-vulnerability-disclosure-policy-and-hall-of-fame
Acknowledgments: https://www.dugganusa.com/post/dugganusa-vulnerability-disclosure-policy-and-hall-of-fame#researcher-hall-of-fame

# We confirm receipt of credible vulnerability reports within two business days.
# 95% epistemic cap on every claim — if our response includes the word
# "100%" anywhere, that is itself a defect worth flagging back to us.
#
# Patrick Duggan, DugganUSA LLC, Minneapolis. May 8, 2026.
# STIX feed: https://analytics.dugganusa.com/api/v1/stix-feed