# Velvet security policy — responsible disclosure
#
# RFC 9116 security.txt. Served at /security.txt (and, once PR-002 narrows the
# dot-path rule, at /.well-known/security.txt — keep the two files identical).
#
# Before public GA: confirm the security@ mailbox is live and monitored by the
# on-call owner, then extend Expires on each anniversary (it must stay < 1 year
# out). `tests/gate/test_ga_artifacts.py` fails if the fields stop parsing.

Contact: mailto:security@velvetcompanionai.com
Expires: 2027-10-27T00:00:00.000Z
Preferred-Languages: en
Canonical: https://velvetcompanionai.com/security.txt
Policy: https://velvetcompanionai.com/security.txt

# What to report (priority order)
#  1. Forgeable payment fulfillment, duplicate grant, negative balance, replay
#  2. Cross-user or paywalled media / transcript exposure
#  3. Session, reset-token, operator-role or MFA bypass
#  4. Intimate content (prompt/message/reasoning/email/cookie) reaching logs,
#     metrics or a third party
#  5. Anonymous resource exhaustion: thread, memory, disk, job, or SSE growth
#
# Severity: critical <=72h (gates paid exposure), high <=7d, medium <=30d with a
# named owner and deadline, low/info by backlog. We acknowledge within 5
# business days and give a triage verdict within 10. Good-faith testing is safe;
# no legal action, no data deletion expected.
#
# Full policy: docs/security/RESPONSIBLE_DISCLOSURE.md