# security.txt for parceldossier.com
# Served at https://parceldossier.com/.well-known/security.txt
# Format: RFC 9116. Derived from legal/SECURITY-INCIDENT.md -- that page is the
# authoritative statement of scope, process and commitments; this file only
# points at it.

Contact: mailto:product@cheppers.com
Expires: 2027-08-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://parceldossier.com/.well-known/security.txt
Policy: https://parceldossier.com/security

# Reports are accepted from customers, independent researchers and members of
# the public through the same channel, without a subscription and without an
# account. Cheppers acknowledges a report within 2 business days.
#
# In scope: unauthorised access to tenant data; exposure of an API credential;
# authentication or authorisation defects; tenant-isolation defects;
# vulnerabilities in the public /v1 API; suspected personal data breaches.
#
# Out of scope for this channel: assessment output you disagree with, and
# coverage or confidence values you consider wrong (support, not security);
# billing and metering disputes (see the Refund Policy); vulnerabilities in AWS
# services themselves (report those to AWS).
#
# Good-faith research terms are stated on the Policy page above. Cheppers does
# not operate a paid bug-bounty programme; no reward is offered or implied.