# Kleidos: how to report a security problem
# RFC 9116: https://www.rfc-editor.org/rfc/rfc9116.html
#
# Kleidos is a hardware password manager. If you have found a way to read a
# vault, bypass the PIN, recover a key, or make the device send a credential
# nobody asked it to send, the address below is the one to write to. Please do
# not open it in public before it is fixed.
#
# This file covers this website and this project. The same person answers at
# the same address for https://jmrp.io/, whose security.txt names the same key.

Contact: mailto:mail@jmrp.io
Encryption: openpgp4fpr:0A993B268654DBBA52B7E8D3FCF653391E2C91FC
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/0A993B268654DBBA52B7E8D3FCF653391E2C91FC
Preferred-Languages: en, es
Canonical: https://kleidos.dev/.well-known/security.txt

# Hiring: security-adjacent work is part of what I do; the CV is the
# canonical place where that is listed.
Hiring: https://jmrp.io/cv/

# Bug-Bounty is registered with IANA (CERT CVD 3.5.5) though it is not in
# RFC 9116 itself. Declared False so a reporter knows up front that there is no
# money behind this, rather than finding out after the work.
Bug-Bounty: False

# Policy, and the advisory-page Contact that belongs beside it, are missing on
# purpose, so that their absence is not read as an oversight. The repository is
# private while I prepare the first release, so both would point at a page you
# could not open. They arrive together on the day it opens. Until then the
# address above is the whole process: write, and I will answer.
#
# This file is not PGP-signed. It is generated when the site is built, so there
# is nothing to sign by hand; the key named above is the same one that signs
# https://jmrp.io/.well-known/security.txt, which you can check against.

# Reviewed and renewed by hand; the site's test suite fails before this passes.
Expires: 2027-10-22T23:59:59.000Z