# Propel — https://propeltech.io
# RFC 9116 security.txt. Served statically from `public/.well-known/`.
#
# Expires is REQUIRED by the RFC and is the one field that rots: a file past its
# expiry is worse than none, because a researcher reads it as "nobody is home".
# Renew it when you touch this file, and note the date in docs/planning/BACKLOG.md if you
# want a reminder that survives this comment.
#
# ONE channel, on purpose. This file used to publish a second Contact — a GitHub
# private-advisory form — and two Policy URLs, and docs/SECURITY.md disowned all three
# in writing: the GitHub mirror is frozen, so "a report opened there may not be
# read", and the company's own remote is a self-hosted Gitea with no advisory
# feature. Publishing a channel nobody watches is worse than publishing one,
# because the researcher who picks it has done everything right and still gets
# silence. The Policy line was absent until 2026-10-25 for the same reason: the
# one that was here pointed at /acceptable-use, which 308-redirects to /legal,
# and /legal carries no disclosure or safe-harbour text at all. /security is a
# real page with both (CASA readiness gap 22); never point this at a redirect.

Contact: mailto:team@clvlabs.tech

Policy: https://propeltech.io/security

Expires: 2027-10-16T00:00:00.000Z

Preferred-Languages: en, es

Canonical: https://propeltech.io/.well-known/security.txt