Contact: mailto:security@flock.city
Contact: mailto:kadeem.yearwood@gmail.com
Expires: 2027-04-26T00:00:00.000Z
Preferred-Languages: en
Canonical: https://flock.city/.well-known/security.txt
Policy: https://flock.city/security
Acknowledgments: https://flock.city/security#hall-of-fame

# Per RFC 9116. Responsible-disclosure window: 90 days standard,
# 30 days for actively-exploited issues. Recognition guaranteed
# for valid reports; financial bounty case-by-case for severity.
#
# In scope: flock.city, beta.flock.city, *.flock.city, Flock iOS/Android apps.
# Out of scope: third-party services (Stripe, Supabase, Vercel) — report to vendor.
#
# Please do NOT: run automated scanners against prod, exfiltrate user data,
# disrupt service, social-engineer team or vendors.