# Churr — security contact (RFC 9116).
#
# If you have found a vulnerability in the Churr app, the API at api.churr.io, or this website,
# please tell us. We will read it, we will answer, and we will not threaten you.
#
# There is no bug bounty. Churr is a two-person startup and we would rather say that plainly than
# imply a payment we cannot make. What we do offer: an answer within five working days, credit in
# the release notes if you want it, and no legal action against anybody acting in good faith under
# the policy below.
#
# The full policy, including what is in scope and what testing we ask you not to do, is at
# https://churr.io/security.html

Contact: mailto:security@churr.io
Expires: 2027-09-16T00:00:00.000Z
Preferred-Languages: en, fr
Canonical: https://churr.io/.well-known/security.txt
Policy: https://churr.io/security.html