# Wrenk Security Policy
# Per RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)

# Both hosts are listed because /.well-known/* is deliberately NOT redirected
# off buildforce.io (server-to-server callers and OAuth metadata depend on it),
# so this file is genuinely served from both. RFC 9116 s2.5.5: a canonical URI
# that does not match where the file was retrieved invalidates it, so every
# serving location has to appear here.
Canonical: https://www.wrenk.ai/.well-known/security.txt
Canonical: https://www.buildforce.io/.well-known/security.txt

# Mailbox stays on buildforce.io until inbound mail is delivered for wrenk.ai
# (see SUPPORT/SECURITY_EMAIL in src/lib/config/brand.ts). A security contact
# that bounces is worse than one on the old domain.
Contact: mailto:security@buildforce.io
Expires: 2027-04-24T00:00:00.000Z
Preferred-Languages: en
# /trust is an authenticated app route — it 307s to /auth, so a researcher
# could never read it. /security is the public page.
Policy: https://www.wrenk.ai/security

# If you discover a security vulnerability, please report it responsibly.
# We aim to acknowledge reports within 48 hours and provide a fix timeline
# within 5 business days.