# LTC — security contact
#
# LTC is a consent and privacy product. A vulnerability here is a privacy
# incident for the people using it, so reports are welcome and will be answered.

Contact: mailto:security@ltc.maib.io
Contact: https://ltc.maib.io/security
Expires: 2027-09-05T00:00:00.000Z
Preferred-Languages: en
Canonical: https://ltc.maib.io/.well-known/security.txt
Policy: https://ltc.maib.io/security

# What we would especially like to hear about
#   - anything that causes LTC to transmit page content, form fields, URLs or
#     browsing history, which it is designed never to do
#   - anything that causes LTC to state a finding its evidence does not support
#   - server-side request forgery in the document fetcher
#   - any way to read another tenant's or another user's Consent Vault
#
# Please do not run automated scanners against the production API. Ask us for a
# staging environment instead.