# How to report a security problem in TacApp.
#
# This file exists so nobody has to guess where to write. Without it,
# a researcher writes to the first address they find — sales, a dealer,
# or a public post.
#
# Format: RFC 9116.

Contact: mailto:security@tacapp.io
Expires: 2027-10-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://www.tacapp.io/.well-known/security.txt

# We answer within two business days. If a week passes with no reply,
# use the contact form at https://www.tacapp.io/#contact and mention
# that your security report went unanswered.
#
# Please give us time to fix it before going public. We will not send
# lawyers after anyone who reports in good faith and did not reach into
# customer data to prove a point.
#
# What you do not need to report: a missing header that protects nothing,
# a library version with no known exploit, or scanner output without
# showing what it does.