Contact: mailto:security@conductloop.com
Contact: https://twitter.com/enriquevaleros
Expires: 2027-12-31T23:59:59z
Preferred-Languages: en, es
Canonical: https://conductloop.com/.well-known/security.txt

# Reporting
# Please email security@conductloop.com with details of any security issue.
# We acknowledge within 48 hours and aim to triage within 5 business days.

# Scope
# - conductloop.com (this website)
# - ops-dashboard.valerosenrique.workers.dev (ConductLoop app)
# - conductloop-api.* (ConductLoop API)
# - iOS / macOS / desktop clients published under the "ConductLoop" name

# Out of scope
# - Third-party integrations (Claude API, OpenAI API, etc.) — report upstream.
# - Rate limiting / brute-force without demonstrable impact.
# - Missing security headers on third-party domains we link to.

# Recognition
# We're a small team. We acknowledge reporters in our public changelog
# after a fix ships, with permission.