# Probity — security contact and disclosure policy (RFC 9116)
#
# Probity is agent-containment infrastructure. If you have found a way out of the
# box, past a gate, or through a signature, we want to hear it before anyone else
# does, and we credit every reporter who asks to be credited.

Contact: mailto:contact@getprobity.dev
Expires: 2027-08-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://getprobity.dev/.well-known/security.txt

# WHAT IS IN SCOPE
#
#   Anything that breaks the claim the product makes: escaping the micro-VM
#   boundary, reaching the host or another tenant from inside it, producing a
#   verdict that verifies but is not true, forging or replaying a signature or a
#   run binding, or making a caught attack read as clean. Also this website, the
#   published specification, the JSON Schemas, and the reference verifiers.
#
# WHAT IS NOT
#
#   Volumetric denial of service, scanner output with no demonstrated impact, and
#   missing headers with no exploit path. There is no paid bounty programme.
#
# WHAT A REPORT SHOULD CARRY
#
#   The exact bytes and the steps. Every verdict published here is offline-
#   verifiable, so a finding about one can be demonstrated end to end without
#   access to anything of ours:
#
#     Reference verifier   https://getprobity.dev/verify/probity-verify.py
#     How to run it        https://getprobity.dev/verify/README.txt
#     Signing public key   https://getprobity.dev/verify/probity.pub
#     Trust anchor         https://getprobity.dev/.well-known/verification-keys.json
#
#   The public key above is an Ed25519 SIGNATURE-verification key. It is named here
#   as the artifact a signature report is about, and deliberately not under an
#   Encryption: field, which RFC 9116 reserves for a key reports are encrypted TO.