# Solid# security contact
# RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:sales@solidnumber.com
Contact: https://solidnumber.com/contact?subject=Security%20Vulnerability
Expires: 2027-06-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://solidnumber.com/.well-known/security.txt
Canonical: https://app.solidnumber.com/.well-known/security.txt
Policy: https://solidnumber.com/security

# There is NO bug bounty program. We do not pay for reports, and requests for
# payment go unanswered. Send real, reproducible issues and we will fix them.
#
# Do not test against customer accounts or data. Do not run automated scanners
# or load against production.
#
# Out of scope (by design, or not a vulnerability without a working exploit):
#  - OAuth dynamic client registration for MCP connectors (RFC 7591). It is
#    how AI assistants connect; registration grants no access, and redirects
#    are limited to approved assistant platforms.
#  - Public discovery documents: /.well-known/*, llms.txt, ai.txt, MCP manifests
#  - Missing or "weak" security headers, SPF/DKIM/DMARC settings
#  - Clickjacking on pages with no state-changing action
#  - Version or banner disclosure, stack traces without sensitive data
#  - Rate-limit or brute-force reports without a demonstrated bypass
#  - Self-XSS, logout CSRF, and issues requiring a compromised device