# Security Policy for Demeterics
# https://securitytxt.org/ (RFC 9116)
#
# This file is served from both demeterics.ai (LLM observability platform) and
# demeterics.com (AI chat widget). Both are Demeterics surfaces of the same
# application, so both URIs are listed as Canonical per RFC 9116 section 2.5.2.
#
# The contact address is on demeterics.com because that domain has mail (MX)
# configured; demeterics.ai serves the web application only.

Contact: mailto:security@demeterics.com
Expires: 2027-06-30T00:00:00.000Z
Preferred-Languages: en

Canonical: https://demeterics.ai/.well-known/security.txt
Canonical: https://www.demeterics.com/.well-known/security.txt

Policy: https://demeterics.ai/security#security-disclosure

# We operate a coordinated vulnerability disclosure program.
# We acknowledge reports within 2 business days and aim to disclose
# within 90 days of the initial report. We do not run a paid bug bounty,
# but we credit reporters who ask to be named.