# RFC 9116 — security.txt for NirvaDeploy
# https://nirvadeploy.com/.well-known/security.txt

Contact: mailto:security@nirvadeploy.com
Expires: 2027-05-13T23:59:59.000Z
Preferred-Languages: th, en
Canonical: https://nirvadeploy.com/.well-known/security.txt
Policy: https://nirvadeploy.com/security
Hiring: https://nirvadeploy.com/about

# Disclosure timeline:
#   1. Email security@nirvadeploy.com with PoC + impact
#   2. We ack within 48 hours
#   3. We patch + notify (typically 30 days)
#   4. Coordinated public disclosure after fix
#
# Out of scope:
#   - Third-party services (Railway, Stripe, Anthropic API) — report to them directly
#   - Social engineering / physical security
#   - Spam (use abuse@ instead)
#
# Hall of Fame:
#   https://nirvadeploy.com/security#hall-of-fame  (Phase 5)