# RFC 9116 security.txt for cnvs.app
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:lukasz@wearfits.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, pl
Canonical: https://cnvs.app/.well-known/security.txt
Policy: https://cnvs.app/about#security

# Scope: cnvs.app domain + all *.cnvs.app subdomains, the Worker behind it,
# and the Cloudflare D1 / Durable Object infrastructure storing board data.
# Out of scope: third-party services (Cloudflare itself, fonts.googleapis.com,
# Google Analytics) — please report those to their respective vendors.
#
# What we care about most:
#   1. Anything that lets a third party read or mutate a board they don't have
#      the URL for (board ID enumeration, IDOR, lock-key bypass).
#   2. XSS / DOMPurify escapes on text or Mermaid content.
#   3. Privilege escalation around the per-board lock (mode: write / all).
#   4. Anything that lets a caller exceed the 5 MiB body cap or per-board quotas
#      from a single isolate.
#
# What we will NOT pay or chase:
#   - Findings that require physical access to a victim's unlocked device.
#   - Self-XSS where the attacker has to convince the victim to paste payload.
#   - Reports based purely on missing security headers without a working exploit
#     (we already ship CSP, X-Robots-Tag, no-store on lock endpoints, etc.).
#   - Volumetric DDoS / L7 floods (Cloudflare handles those).
#
# Disclosure: we'll respond within 5 business days. Coordinated disclosure
# preferred — let us ship a fix before publishing.