# Security and abuse contacts for dropto.run, per RFC 9116.
#
# Two addresses, because they are two different jobs and the RFC reads the order as preference:
#
#   security@  a vulnerability in this service. Please give us a chance to fix it before making it
#              public. Testing is welcome against your own sites; please do not test against sites
#              belonging to other people.
#   abuse@     content someone published through the service — phishing, malware, anything that has to
#              come down. This is the address a brand-protection vendor or an upstream provider should
#              write to, and it is monitored.
#
# Expires is not decoration: a security.txt whose date has passed is treated as invalid, and scanners
# report the file as missing rather than stale. test/seo.test.ts fails while there is still a month left
# on it, so this gets renewed by a red test rather than by someone remembering.

Contact: mailto:security@dropto.run
Contact: mailto:abuse@dropto.run
Expires: 2027-08-18T23:59:59.000Z
Preferred-Languages: en, vi
Canonical: https://dropto.run/.well-known/security.txt
Policy: https://dropto.run/contact