# Security policy for goldprice.dev
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:hello@goldprice.dev
Expires: 2027-04-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://goldprice.dev/.well-known/security.txt
Policy: https://goldprice.dev/terms

# In scope:
#   - https://goldprice.dev (frontend, marketing, dashboard)
#   - https://api.goldprice.dev (REST API + MCP server)
#   - https://yjdcwlvcabblujksfsiq.supabase.co (auth + database)
#
# Out of scope:
#   - Third-party services we depend on (Stripe, Sentry, Resend,
#     Upstash, Vercel, Fly.io, Cloudflare, Supabase auth)
#
# Please report responsibly. We aim to acknowledge within 72 hours and
# address valid issues per severity. We don't currently run a paid
# bounty program but credit reporters who request it (with permission)
# in the security advisory.