# ninja.ing Security Policy
# RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116
# If you find a vulnerability, please report it responsibly.

Contact: mailto:security@ninja.ing
Contact: mailto:scott.gardner@ninja.ing
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://ninjasignal.ninja/.well-known/security.txt
Policy: https://ninja.ing/security-policy

# We appreciate your help keeping the ninja.ing ecosystem secure.
# Responsible disclosure is rewarded with acknowledgment and gratitude.
#
# Scope: *.ninja.ing, ninjasignal.ninja, ninjafusion.ninja,
#         ninjaraz0r.ninja, ninjaken0bi.ninja, ninjanexus.ninja,
#         ninjav0id.io, 1d.ninja.ing, gitair.ninja
#
# Out of scope: Third-party services, social engineering, DoS/DDoS
#
# -----
# "The best defense is a good offense... but responsible disclosure is better."
# — ninja.ing security team
#
# P.S. If you're reading this, you're our kind of person.
#      We build threat intelligence tools. Come say hi: scott.gardner@ninja.ing