Contact: https://github.com/ProofVisorAI/proofvisor/security/advisories/new
Expires: 2027-08-25T00:00:00.000Z
Preferred-Languages: en
Canonical: https://proofvisor.com/.well-known/security.txt
Policy: https://github.com/ProofVisorAI/proofvisor/blob/main/SECURITY.md
Acknowledgments: https://github.com/ProofVisorAI/proofvisor/blob/main/SECURITY-AUDIT.md

# ProofVisor security disclosure — RFC 9116 (securitytxt.org).
#
# We welcome coordinated disclosure. Please open a private security
# advisory (the Contact URL above) with a description of the issue,
# reproduction steps, and any suggested remediation. (Email contact
# lands with the beta's mail domain — the domain has no MX today, so
# no mailto is listed: a dead mailbox is worse than none.) We aim to acknowledge within 48h and ship a fix within 14
# days for high/critical severity.
#
# In-scope surfaces:
#   • proofvisor.com and *.proofvisor.com
#   • the ProofVisor console SPA at /app
#   • the hosted API (launches with the beta; in scope from day one)
#   • the on-device daemon (crates/pv-harness + crates/pv-atif in this repo)
#
# Out of scope: dependency CVEs already tracked upstream, findings that
# require an already-compromised administrator account, DoS via unbounded
# request payloads (rate-limited at the edge).