Contact: mailto:security@inscan.space
Contact: https://www.inscan.space/security
Expires: 2027-12-31T23:59:59Z
Preferred-Languages: en, zh
Canonical: https://www.inscan.space/.well-known/security.txt

# We accept coordinated vulnerability disclosures for any security issue
# affecting the SecurityScanner web application, API, or worker. We aim to
# acknowledge reports within 2 business days and provide a remediation
# timeline within 5 business days. We do not pursue legal action against
# good-faith security research that complies with this policy.
#
# Scope:
#  - https://www.inscan.space/* (Next.js app)
#  - https://security-scanner-worker.fly.dev/* (scan worker)
#  - https://api.inscan.space/* (REST API)
#
# Out of scope:
#  - Denial of service / volumetric attacks
#  - Social engineering of staff
#  - Physical attacks against infrastructure
#  - Recently-disclosed 0-days within 14 days of public disclosure
#    (we follow the standard 14-day patching window)
#
# Safe harbour: We will not pursue legal action against researchers who:
#  - Avoid privacy violations, data destruction, or service disruption
#  - Only interact with accounts they own or have explicit permission for
#  - Stop testing immediately if they encounter user data and notify us
#  - Give us reasonable time to remediate before public disclosure