# RFC 9116. The API host serves its own copy from
# apps/api/src/routes/well-known.ts; this one exists because a researcher
# looks for the file on the domain they are reporting about, and that domain
# is the site, not the API.
#
# Static, so `Expires` is a date someone has to move. It is a year out and
# the RFC says a stale file should be treated as invalid, which is the point:
# an expired contact is a contact nobody checked.
# Not a no-reply. This file collects vulnerability reports, and an address
# that drops them advertises a channel that does not exist, which is worse
# than publishing none at all (#137). `contact@` is what the legal notice
# names, so it is monitored regardless of this file.
Contact: mailto:contact@scenivia.com
Expires: 2027-08-10T00:00:00.000Z
# RFC 9116 section 2.5.2: where this file is authoritative, so a copy served
# from anywhere else cannot pass for it. The API's copy names its own host.
Canonical: https://scenivia.com/.well-known/security.txt
Preferred-Languages: fr, en