# Mastheads security contact, per RFC 9116.
# Report a vulnerability to security@mastheads.app. Please do not open it in
# public first.
#
# RENEW THIS FILE BY 1 SEPTEMBER 2027. Nothing reminds anyone.
# The Expires field below is required by RFC 9116, and a date in the past does
# not merely age the file - it makes the whole file invalid, so a scanner is
# meant to ignore every line in it, the contact address included. That failure
# is silent: no error, no bounce, no gate watching the date. If you are reading
# this on or after 1 September 2027, push Expires out about a year and redeploy.
# Nothing else in this file has to change.
#
# Only fields we can actually honour are listed. No Encryption (no PGP key is
# published), no Acknowledgments or Policy (neither page exists), and no
# response-time commitment (there is no rota to hold one).

Contact: mailto:security@mastheads.app
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://mastheads.app/.well-known/security.txt