# Coordinated disclosure for SinceCode.
#
# Our Acceptable Use Policy links here from the clause that forbids probing the
# service, so this file is the other half of that sentence: the route that makes
# the prohibition reasonable. Before it existed the AUP pointed at a 404, which
# reads as "do not test us, and do not tell us either".
#
# https://www.rfc-editor.org/rfc/rfc9116

# ⚠️ THE URLS BELOW ARE build.sincecode.com, NOT sincecode.com, AND THAT IS
# DELIBERATE. Please do not "correct" them back.
#
# sincecode.com is the marketing site and is a SEPARATE service on different
# hosting — this application does not serve that hostname and cannot be made to.
# Until 2026-09-28 all three of these pointed there, and all three were 404:
#
#   https://sincecode.com/.well-known/security.txt   404
#   https://sincecode.com/takedown                   404
#   https://sincecode.com/acceptable-use             404
#
# A Canonical that 404s is worse than no Canonical at all: RFC 9116 §2.5.3 has
# researchers check it to confirm the file is genuinely ours, so a dead one
# invites them to treat this whole file as planted. And the Contact and Policy
# links are the ones a person follows at the moment they have something to tell
# us, which is the worst possible moment to hand them a 404.
#
# The RIGHT end state is the apex serving or redirecting /.well-known/security.txt,
# because that is where a researcher looks first. That is a change to the
# marketing site, not to this repo. Until it happens, these point at the host
# that actually answers.

# security@ was published here before it existed, so researchers' reports
# bounced — the worst outcome for a file whose whole job is to be reachable.
# It briefly pointed at abuse@ so reports would arrive at all. The mailbox was
# created on 2026-09-29 and this is back where it belongs.
#
# ⚠️ IF YOU CHANGE THIS LINE, CHECK THE MAILBOX EXISTS FIRST. That is the whole
# story of this file: it named three URLs that 404'd (02331d9a) and then a
# mailbox nobody had made (927bc8f3). Both were published for weeks, and neither
# was caught by anything, because a contact route is the one thing nobody tests
# until they need it.
Contact: mailto:security@sincecode.com
Contact: https://build.sincecode.com/takedown
Expires: 2027-09-21T00:00:00.000Z
Preferred-Languages: en
Canonical: https://build.sincecode.com/.well-known/security.txt
Policy: https://build.sincecode.com/acceptable-use

# If you have found something, we would rather hear about it early and roughly
# than late and polished. Tell us what you did, what you saw, and what you think
# it means. You will get a human reply.
#
# Please do not: run automated scanners against customer sites, access or modify
# data that is not yours, or degrade the service to demonstrate that you can.
# A description is enough — we will reproduce it ourselves.