# upAPI — security contact (RFC 9116)
#
# Served at https://upapi.io/.well-known/security.txt, the one path scanners,
# bug-bounty tooling and several AI answer engines probe to decide whether a
# domain has a reachable owner. It was a 404 (SEO audit F9d).
#
# Contact order is deliberate. The support form is a PROVEN surface: it is the
# `bugs.url` of both published npm packages and it has a live prod E2E spec
# against it. The mailbox is listed second because it is the address the Terms
# and the Privacy Policy already publish, but CLAUDE.md records that the owner
# has not yet proven support@upapi.io receives mail — so it must not be the only
# way in.
#
# TODO(renew before 2027-09-14): `Expires` below is a hard RFC 9116 field and a
# file past its expiry is INVALID, not merely stale — tooling stops reading it.
# `lib/__tests__/security-txt.test.ts` fails the build 30 days out, so this is a
# check rather than a diary entry; bump the date and the test goes green again.

Contact: https://app.upapi.io/support
Contact: mailto:support@upapi.io
Expires: 2027-09-14T00:00:00.000Z
Preferred-Languages: en
Canonical: https://upapi.io/.well-known/security.txt
Policy: https://upapi.io/terms