# Dokimore Platform — security disclosure policy (RFC 9116) # https://www.rfc-editor.org/rfc/rfc9116 # # 2026-09-01 — this file MOVED here from the repository root. The copy at # /.well-known/security.txt was never served: it sat outside frontend/public/, # so it was not in the built image and returned 404 while /robots.txt returned # 200. A disclosure policy nobody can fetch is not a disclosure policy. # # Fields that pointed at pages which DO NOT EXIST (a hall-of-fame, a separate # disclosure-policy page, a PGP key) have been removed rather than published as # dead links — a researcher who cannot reach the contact route gives up or goes # public. Re-add each one only when the thing it points at actually exists. # # The domain below is the repo-wide placeholder and is rewritten in one step by # `node frontend/scripts/set-site-url.mjs https://` when the domain # is bought. Until then this file ships but is not reachable from the internet, # because the product itself is not yet published on a public domain. Contact: mailto:security@dokimore.com Expires: 2027-06-01T00:00:00.000Z Preferred-Languages: en Canonical: https://dokimore.com/.well-known/security.txt Policy: https://dokimore.com/legal/vulnerability-disclosure # Scope # - The Dokimore platform and its API # - Production deployments on the canonical domain above # # Out of scope # - Third-party services we integrate with (report to them directly) # - Denial-of-service and volumetric testing against production # # Response targets (targets, not contractual SLAs) # - Critical: first response within 24 hours # - High: first response within 72 hours # - Other: first response within 7 days # # Safe harbour # We will not pursue legal action against researchers who act in good faith, # follow this policy, avoid privacy violations and service disruption, and give # us reasonable time to remediate before public disclosure.