# Gatherings — coordinated vulnerability disclosure (RFC 9116).
# Served at https://gatheringsapp.com/.well-known/security.txt (Firebase "marketing" target,
# site/public/.well-known/ — same path as apple-app-site-association / assetlinks.json).
#
# @requirement SEC-CAMPUS-SWEEP — pre-campus security sweep & hardening (coordinated-disclosure gap 1)
# @adr ADR-005 — Three-Tier Privacy Model (a friendly report reaches us, not X)
#
# Disclosure address set by the founder 2026-09-01 (SEC-CAMPUS-SWEEP open decision 1 resolved):
# a shared alias, not a personal inbox. Keep it monitored.
Contact: mailto:security@gatheringsapp.com

# The disclosure policy, scope, and safe-harbor terms live in SECURITY.md.
# ⚠️ Small pre-site-deploy ops item: publish a page at the Policy URL below (render SECURITY.md at
# gatheringsapp.com/security-policy, or redirect it) BEFORE this file goes live, so the link resolves.
Policy: https://gatheringsapp.com/security-policy

# Expires ~1 year out — refresh on/before this date (RFC 9116 §2.5.5; a stale file is ignored).
Expires: 2027-08-31T23:59:59.000Z

Preferred-Languages: en

Canonical: https://gatheringsapp.com/.well-known/security.txt