# Sodium - Security contact and disclosure policy (RFC 9116)
# https://sodiumhq.com/.well-known/security.txt
#
# We welcome good-faith reports of genuine security issues affecting Sodium.
# Email the contact below with clear reproduction steps and evidence of real,
# demonstrated impact, and allow us reasonable time to respond before any
# public disclosure.
#
# Our stance:
#  - We do NOT operate a paid bug bounty program and do not pay compensation
#    for unsolicited reports. Reports are handled on a responsible-disclosure
#    basis only.
#  - Theoretical findings or raw automated-scanner output with no demonstrated
#    real-world impact may be acknowledged but will not necessarily be actioned.
#  - Do not degrade our service, access data that is not yours, or run
#    volumetric / denial-of-service testing against our systems.

Contact: mailto:security@sodiumhq.com
Expires: 2027-07-06T00:00:00.000Z
Preferred-Languages: en
Canonical: https://sodiumhq.com/.well-known/security.txt