Standard RFC 9116 security.txt & Coordinated Disclosure Policy

# Vulnerability Disclosure Policy & RFC 9116 security.txt

At [Company Name], we prioritize the security and confidentiality of our users. We welcome coordinated vulnerability reports from independent security researchers and ethical hackers.

---

## 1. RFC 9116 security.txt Specification
Place this exact text file at `https://domain.com/.well-known/security.txt`:

```http
# Official Security Contact
Contact: mailto:[email protected]
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, tr
Encryption: https://domain.com/pgp-key.txt
Canonical: https://domain.com/.well-known/security.txt
Policy: https://domain.com/security-policy
Acknowledgments: https://domain.com/hall-of-fame
```

---

## 2. Coordinated Disclosure Guidelines
We ask all security researchers to abide by the following ethical guidelines:
- **Do No Harm:** Avoid privacy violations, destruction of data, and interruption or degradation of our services (e.g., DoS/DDoS attacks are strictly out of scope).
- **Zero Data Exfiltration:** If you identify sensitive data, do not download, view, or retain more data than necessary to demonstrate proof-of-concept.
- **Confidentiality:** Please give our security engineering team **90 days** to investigate and deploy patches before publicly disclosing any vulnerability.

---

## 3. Legal Safe Harbor Guarantee
If you make a good faith effort to comply with this policy during your security research, we pledge:
- We will consider your research **authorized** under relevant anti-hacking laws (including CFAA and computer crime legislation).
- We will not initiate or support any legal action against you regarding your research activities.
- We will work transparently with you to validate, triage, and acknowledge your contribution in our Security Hall of Fame.