# ====================================================================
# SECURITY.TXT
# Compliant with RFC 9116
# ====================================================================

# Contact information for reporting security vulnerabilities
Contact: mailto:security@animaapp.com

# Link to the canonical security policy page
Policy: https://support.animaapp.com/en/articles/2726094-security-at-anima

# Preferred language for communication
Preferred-Languages: en


# ====================================================================
# VULNERABILITY DISCLOSURE POLICY & PROGRAM TERMS
# ====================================================================
#
# 1. NO BUG BOUNTY PROGRAM
# We do not operate a financial bug bounty program. Under no circumstances 
# will financial compensation, payments, or rewards be offered or provided 
# for unsolicited security reports.
#
# 2. OUT-OF-SCOPE REPORTING
# The following findings are explicitly out of scope and will be closed 
# without review or response:
# - Automated scanner outputs or raw tool reports without a validated, 
#   exploitable Proof of Concept (PoC).
# - Missing HTTP security headers (e.g., Content-Security-Policy, 
#   X-Frame-Options, Strict-Transport-Security) unless accompanied by a 
#   working exploit demonstration.
# - Missing SPF, DKIM, or DMARC record configurations.
# - Disclosure of low-risk software version banners or server configurations.
# - SSL/TLS best practices or weak cipher suite reports.
# - Rate limiting or brute force optimization reports.
# - Low risk redirection or injection that have little or no risk potential.
#
# 3. SAFE HARBOR
# We support good-faith, responsible security research. If you comply with 
# this policy, do not disrupt operations, and do not access or compromise 
# user data, we will not pursue legal action against you.
#
# 4. DISCLOSURE DEADLINE
# We request that you keep all findings strictly confidential and allow our 
# engineering teams a minimum of 90 days to remediate any validated issues 
# before any public discussion or disclosure.
#
# ====================================================================