# OssFin — security contact (RFC 9116)
#
# Served as a static file. NOTE for whoever edits vercel.json: the SPA rewrite
# must keep excluding `.well-known/`, or this path returns index.html with a
# 200 and content-type text/html — which is how it behaved until 2026-09-29.
# A scanner records that as "security.txt present" and a researcher sees a web
# page where a policy should be. A 404 would have been more honest.

Contact: mailto:security@ossfin.com
Expires: 2027-09-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://www.ossfin.com/.well-known/security.txt
Policy: https://www.ossfin.com/security-policy