# Sigil security contact
#
# Expires is mandatory under RFC 9116 and a file past its expiry is treated as
# invalid, which fails silently: the page keeps serving, researchers' tooling
# just stops trusting it. Renew this before the date below.
#
# Served from /.well-known/security.txt. Any origin config that blocks dotfile
# paths hides this file while the rest of the site looks healthy, so the web
# server needs an explicit carve-out for /.well-known/.

Contact: mailto:security@sigilchat.com
Expires: 2027-08-19T00:00:00.000Z
Canonical: https://sigilchat.com/.well-known/security.txt
Policy: https://sigilchat.com/advisories#reporting
Preferred-Languages: en