# iTutorOnline vulnerability disclosure
#
# Found a security problem on itutoronline.com? Please tell us. Mail the address
# below with enough detail to reproduce it: the URL, the steps you took, and what
# you saw. A real person reads every report and will write back.
#
# In scope: itutoronline.com and its subdomains, our API, and the tutor and
# student apps served from them.
#
# Out of scope: raw scanner output with no working proof, missing headers with no
# demonstrated impact, issues in services we do not operate (Supabase, Stripe,
# Vercel, Cloudflare, AWS SES), and anything needing physical access or an
# already compromised device.
#
# Ground rules, because this is a live site with real students and real payments:
# no denial-of-service or load testing, no automated scanning that degrades the
# service, and never read, change or keep data that is not yours. Bookings, chat
# messages and payment records belong to real families. Make your point with your
# own test accounts.
#
# We do not run a paid bug bounty. We will credit you by name if you would like
# that, and we will not pursue legal action over research that stays inside the
# rules above. Please give us a reasonable window to ship a fix before you
# publish.
#
# Maintenance: Expires must stay less than a year out (RFC 9116 section 2.5.5).
# Renew the date below when you touch this file; the guard test in
# src/app/__tests__/security-txt.test.ts fails once it is inside 30 days.

Contact: mailto:contact@itutoronline.com
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en, nl, fr
Canonical: https://itutoronline.com/.well-known/security.txt