# mcprush — how to tell us about a hole in this site.
#
# RFC 9116. This marketplace publishes a security grade for every listing in
# it, so having no channel for a report about itself was the one omission
# nobody would have forgiven. It answered 404 until this file existed.
#
# SERVED BY NGINX OFF THE DISK, not by the application — see the
# `location = /.well-known/security.txt` block in ops/nginx-mcprush.conf. The
# sign-in gate in front of the rest of the site would have met a researcher
# with a password prompt, which is the same dead end as the 404 was.
#
# The mailbox is the first contact deliberately: /contact is a page, and while
# the site is private a page is behind the gate. Mail is not.
#
# EXPIRES IS A PROMISE WITH A DATE ON IT. A stale security.txt is worse than
# none — it names a channel nobody is watching. Whoever moves the date forward
# is confirming the mailbox is still read.

Contact: mailto:support@mcprush.com
Contact: https://mcprush.com/contact
Expires: 2027-08-12T00:00:00.000Z
Preferred-Languages: en
Canonical: https://mcprush.com/.well-known/security.txt
Policy: https://mcprush.com/trust