# RFC 9116: how to report a security problem with ChainChoice.
# Written by scripts/generate-security-page.ts from data/security/policy.json; the policy in full is at the Policy URL.

Contact: mailto:mathias@cryptopaymentfinder.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://chainchoice.io/.well-known/security.txt
Policy: https://chainchoice.io/security
Acknowledgments: https://chainchoice.io/security#acknowledgments

# In scope:
#   chainchoice.io, its subdomains and every address under them, including the API under /api/ and the public API under /api/v1/.
#   chainchoice.vercel.app, which serves the same deployment.
# Out of scope:
#   Services we use but do not run, such as our hosting, database and data providers: please report those to the vendor.
#   Volumetric denial-of-service tests.
#   Findings that need control of the reader's own device.
# Please do not publish details until a fix has shipped or 90 days have passed since your report, whichever comes first.