# Vulnerability disclosure for spiced.gg
#
# RFC 9116. The field names and their order are fixed by that spec, which is why
# this file looks nothing like the rest of the site.
#
# Contact is a form rather than an address on purpose: a published mailbox is a
# published mailbox, and this one would sit on a page every scanner reads. It is
# the platform's own /contact form, the one way in for every kind of report.
#
# Expires is required by the spec and is the field that rots. A security.txt
# past its expiry is one researchers are told to disregard, so tests/security-txt
# fails the build a month before this date arrives rather than after.

Contact: https://spiced.gg/contact
Expires: 2027-07-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://spiced.gg/.well-known/security.txt
Policy: https://spiced.gg/security