# Korely security policy and responsible disclosure
# https://www.rfc-editor.org/rfc/rfc9116.html

Contact: mailto:security@korely.ai
Expires: 2027-05-02T00:00:00.000Z
Preferred-Languages: en, it
Canonical: https://korely.ai/.well-known/security.txt
Policy: https://korely.ai/legal/privacy-policy.html

# Reporting vulnerabilities
#
# If you have discovered a security vulnerability that affects Korely or any of
# its services, please report it via email to security@korely.ai. Encrypted
# email is welcome but not required for initial contact.
#
# In your report, please include:
#   - A description of the vulnerability and its potential impact
#   - Steps to reproduce, including any relevant URLs, inputs, or screenshots
#   - The version, environment, or build affected (if known)
#
# We aim to acknowledge reports within 5 business days and to provide an initial
# triage assessment within 14 business days. We will keep you informed about the
# remediation status until disclosure.
#
# Out of scope:
#   - Reports generated solely by automated scanners without supporting evidence
#   - Best-practice findings without an exploitable security impact
#   - Social engineering of Korely staff or users
#   - Denial-of-service attacks or volumetric testing
#
# Korely does not currently offer paid bug bounties. We appreciate responsible
# disclosure and will publicly acknowledge researchers who follow this policy
# upon request.