# Aura security contact (RFC 9116)
#
# Contact routes to info@orgwareconstruct.com, a real monitored mailbox for
# Orgware Construct Pvt. Ltd. If the operator ever changes, update the
# Contact line below before it goes stale.
#
# Expires must stay less than one year out -- a file that has expired is
# treated as invalid by scanners and by researchers. Renew this annually.

Contact: mailto:info@orgwareconstruct.com
Contact: https://auratt.com/support.html#security
Expires: 2027-09-20T00:00:00.000Z
Preferred-Languages: en
Canonical: https://auratt.com/.well-known/security.txt
Policy: https://auratt.com/support.html#security

# What we ask of you: report in good faith, stay within your own accounts
# and test data, do not degrade the service for other people, and give us a
# reasonable window before publishing.
#
# What we commit to: acknowledgement within 7 days, an intended course of
# action within 30, no legal action against good-faith researchers, and
# credit if you want it. There is no bug bounty.
#
# Already known and published, so expect a "yes, we wrote that down" reply:
#  - The hosted web app at app.auratt.com holds users' device private keys
#    server-side and can therefore see plaintext. Documented at
#    https://auratt.com/security.html
#  - macOS builds are neither code-signed nor notarized. Documented at
#    https://auratt.com/download.html