# ─────────────────────────────────────────────────────────────
# freecupholder.zip — security.txt (RFC 9116)
#
# You found the file. Of course you did.
#
# If you have found something in my stuff, I want to hear about
# it, and I will treat you the way I want to be treated when the
# roles are reversed. Rule 02 applies: ack within 48h, faster if
# it is interesting.
#
# There is deliberately no email address and no contact form on
# this domain. X DMs are the channel. A HackerOne program is
# coming; when it is live it goes in the Contact list above and
# becomes the preferred route for anything with a CVE in it.
# ─────────────────────────────────────────────────────────────

Contact: https://x.com/freecupholder
# Contact: https://hackerone.com/freecupholder   <- re-enable when the
#   HackerOne profile is live. Until then it is deliberately commented out:
#   an RFC 9116 Contact that does not answer is worse than one fewer contact.

Expires: 2027-07-21T00:00:00.000Z

Preferred-Languages: en, ja

Canonical: https://freecupholder.zip/.well-known/security.txt

# ── Scope ───────────────────────────────────────────────────
# In scope:      freecupholder.zip and its subdomains
# Out of scope:  third-party services linked from this site
#                (GitHub, X, HackerOne)
#
# Fair warning on scope: this domain is a static site. There is
# no application, no database, no server-side code, and no form
# that accepts input. If you are fuzzing for injection here you
# will not find any, because there is nothing on the other end
# to inject into. Infrastructure and header findings are still
# welcome.

# ── Rules of engagement ─────────────────────────────────────
# 01 — Real names optional. Real scope mandatory.
# 02 — Acknowledgement within 48 hours.
# 03 — "Urgent" with no details gets read last.
# 04 — No automated scanning that degrades availability for
#      anyone else. Rate limits exist; please do not test them
#      by exhausting them.
# 05 — No social engineering, no physical, no DoS.
# 06 — Do not access, modify, or exfiltrate data that is not
#      yours. Prove the bug, then stop.
#
# Act in good faith and I will not come after you. That is the
# whole agreement.

# ── Acknowledgements ────────────────────────────────────────
# Reporters who want credit get it. Reporters who want to stay
# anonymous stay anonymous. Ask, and it is honored either way.

Policy: https://freecupholder.zip/.well-known/security.txt