# Helmwart — security contact
# https://helmwart.com/.well-known/security.txt
#
# RFC 9116. If you have found a vulnerability in Helmwart, mail the address
# below. You will get a human, not a ticket robot.
#
# What we ask: give us the steps to reproduce it, and give us a chance to fix it
# before you publish. What we will not do: threaten you for reporting something
# in good faith, or argue about whether it counts.
#
# In scope: helmwart.com and its subdomains, the `helmwart` CLI as published on
# npm and through the Homebrew tap, and the content API those two share.
#
# Out of scope, because they are not ours to fix: findings in Vercel, Supabase or
# Cloudflare themselves — report those to the vendor. Also out of scope: reports
# generated by a scanner with nothing behind them, and anything that requires us
# to disable a control first.
#
# NOTE ON THE THREAT CONTENT. Helmwart publishes a catalogue of agentic-AI
# threats. Finding one of those described on the site is not a vulnerability
# report — that is the product. This address is for defects in the software and
# the service.

Contact: mailto:support@helmwart.com
Expires: 2027-09-14T00:00:00.000Z
Preferred-Languages: en, nb
Canonical: https://helmwart.com/.well-known/security.txt

# Expires is a hard commitment, not a formality: RFC 9116 says a consumer MUST
# ignore this file once the date passes, so letting it lapse is the same as
# deleting it. tests/content/security-txt.test.ts fails 30 days before that date
# so it gets renewed by someone deciding to, rather than by nobody noticing.