# Qbox AI — security contact information (RFC 9116).
#
# QBO-1317 / CASA §7. Served as a STATIC asset out of `public/`, so it is
# reachable at https://qbox-ai.com/.well-known/security.txt with no route,
# rewrite or middleware involved.
#
# MAINTENANCE: `Expires` below is a hard requirement of RFC 9116 §2.5.5 and a
# scanner-visible one — an expired file is treated as absent, which is the same
# finding as having no file at all. Refresh it before it lapses and keep the
# window at or under one year. The contact address and the policy URL must stay
# in lockstep with SECURITY.md at the repo root.
#
# EVERY URL IN THIS FILE MUST BE PUBLICLY RESOLVABLE. The whole point of the
# file is unauthenticated consumption by external researchers and scanners, so
# a link that needs a login is the same defect as a 404. In particular do NOT
# point `Policy` at a file in this repository — the GitHub repo is PRIVATE
# (`gh repo view --json visibility` → PRIVATE), so a blob URL 404s for the only
# audience that reads this. `Policy` points at the public marketing page
# (src/views/Security.tsx → https://qbox-ai.com/security), whose "Reporting a
# vulnerability" section is the published disclosure policy; SECURITY.md is the
# internal-facing mirror of the same text.

Contact: mailto:security@qbox-ai.com
Expires: 2027-09-01T00:00:00.000Z
Canonical: https://qbox-ai.com/.well-known/security.txt
Policy: https://qbox-ai.com/security
Preferred-Languages: en