Vulnerability disclosure policy

This page is a placeholder outline, not a final legal document. It must be completed and reviewed by a qualified lawyer before launch.

• Scope: [website and service domains]
• How to report: email [security@your-domain] with the steps to reproduce
• Please do not access other people’s data, run denial-of-service tests or use social engineering
• We will acknowledge your report within [x] business days and keep you updated
• Safe harbour: [wording to be reviewed by counsel]
• Add a /.well-known/security.txt file at launch