# LockedIn Labs FDE — security contact and disclosure policy
# https://lockedin-fde-platform.netlify.app/.well-known/security.txt
# Format: RFC 9116.
#
# ONE ADDRESS, AND IT IS NOT A FUNNEL. RFC 9116 makes Contact the one field a
# valid file cannot omit, so this file names security@lockedinlabs.ai — the
# firm's own disclosure mailbox. It names nothing else. There is no sales
# address here, no support alias and no "get in touch" route, because a
# researcher reporting a flaw and a buyer asking a question are not the same
# person and this file only owes the first one a route.
#
# WHY THE MAILBOX AND THE CANONICAL URI ARE ON DIFFERENT DOMAINS. The platform
# is served from a Netlify host today and has no custom domain yet, so
# Canonical names the URI this file is actually fetched from — which is the
# whole point of the field, and a Canonical naming a host the file is not
# served from is the first ticket a reviewer opens. A `netlify.app` subdomain
# cannot carry a mailbox, so Contact names the firm's apex instead. RFC 9116
# permits the two to differ; what it does not permit is either one being wrong.
#
# WHAT WAS CHECKED BEFORE THE LINE CHANGED (2026-09-07, with the rename from
# the codebase's previous lineage). `dig MX lockedinlabs.ai` answers the five
# Google Workspace exchangers — `aspmx.l.google.com` and its four alternates —
# so mail addressed here is routed rather than refused at the edge. Whether a
# particular local part delivers is a mailbox setting behind that record, and
# keeping `security` a delivering mailbox is an operating obligation rather
# than a formality: an address that bounces silently turns a researcher who was
# trying to help into one who concludes nobody is listening, which is worse
# than publishing no file at all.
#
# This file used to carry a second Contact line pointing at a contact page.
# That page no longer exists and the product publishes no contact route, so the
# mailbox is the whole of the route and Policy below is where the terms are.

Contact: mailto:security@lockedinlabs.ai
Expires: 2027-08-19T00:00:00.000Z
Preferred-Languages: en
Canonical: https://lockedin-fde-platform.netlify.app/.well-known/security.txt
Policy: https://lockedin-fde-platform.netlify.app/security

# WHAT THE POLICY LINK LEADS TO. Not a bug-bounty page — there is no bounty, and
# saying so plainly is the point. /security is the third-party risk page. Every
# claim on it carries a standing of Live, Proposed or Not held, and the sections
# marked Not held say which attestations this product lacks; a researcher who
# reads those first will find several standing gaps already written down, which
# should save both sides a report. That section sits tenth of eleven, after the
# implemented controls and their dated evidence, and a release test pins it
# there deliberately.
#
# NOT IN SCOPE, and stated here so nobody spends an afternoon on one: a version
# banner, TLS configuration owned by the managed host, and any finding that
# requires an already-compromised operator credential. Also out of scope, and
# named because a header scanner will flag it within seconds: `script-src` on
# the cached marketing pages permits 'unsafe-inline'. That is known, deliberate
# and documented — a per-request nonce cannot exist on a document served from a
# CDN cache, and the routes that render per request, which is all of /app and
# both sign-in forms, do carry one. Tenant isolation IS in scope and is the
# finding we most want.