# Security policy for exchangerate.dev
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:support@exchangerate.dev
Expires: 2027-04-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://exchangerate.dev/.well-known/security.txt
Policy: https://exchangerate.dev/terms

# In scope:
#   - https://exchangerate.dev (frontend, marketing, dashboard)
#   - https://api.exchangerate.dev (REST API + MCP server)
#   - https://oxdexjqtfodlvzskawlt.supabase.co (auth + database)
#
# Out of scope:
#   - Third-party services we depend on (Stripe, Sentry, Vercel,
#     Fly.io, Cloudflare, Supabase auth)
#
# Please report responsibly. We aim to acknowledge within 72 hours and
# address valid issues per severity. We don't currently run a paid
# bounty program but credit reporters who request it (with permission)
# in the security advisory.