# Endless — vulnerability disclosure (RFC 9116)
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:support@endless.page
Expires: 2027-04-27T00:00:00Z
Preferred-Languages: en
Canonical: https://endless.page/.well-known/security.txt

# Scope: endless.page and its subdomains. The data we care most about
# protecting is user account credentials, billing data flowing through
# Stripe, and the integrity of price/clearance data.
#
# Out of scope: scraped retailer catalog data (sourced from public
# product pages), our anomaly-detection scoring algorithm.
#
# Please give us 72 hours to acknowledge before public disclosure.
# Bug-bounty program: not currently offered, but we credit reporters
# in release notes on request.