# BoardWalk — security contact and disclosure policy
# https://theboardwalk.ai/.well-known/security.txt
# Format: RFC 9116.
#
# THE MAILBOX IS REAL, AND IT WAS PROVEN BEFORE IT WAS PRINTED. An address
# that bounces silently converts a researcher who was trying to help into one
# who concludes nobody is listening — so this file's Contact only ever names a
# mailbox whose delivery has been proven end-to-end with a real message before
# the line changed. First proven for security@portfolioplane.com on
# 2026-08-15; re-proven for security@theboardwalk.ai on 2026-08-17 when the
# brand moved domains (inbound MX published at the theboardwalk.ai apex,
# receiving verified, a real message delivered and read back). RFC 9116
# §2.5.3 lists Contact fields in order of preference: the mailbox first, the
# page as the fallback route.

Contact: mailto:security@theboardwalk.ai
Contact: https://theboardwalk.ai/contact
Expires: 2027-08-16T00:00:00.000Z
Preferred-Languages: en
Canonical: https://theboardwalk.ai/.well-known/security.txt
Policy: https://theboardwalk.ai/security

# WHAT THE POLICY LINK LEADS TO. Not a bug-bounty page — there is no bounty, and
# saying so plainly is the point. /security is the third-party risk page. Every
# claim on it carries a standing of Live, Proposed or Not held, and the sections
# marked Not held say which attestations this product lacks; a researcher who
# reads those first will find several standing gaps already written down, which
# should save both sides a report. (This note used to claim the page OPENED with
# what is not held. It does not — that section is tenth of eleven, and a
# release test pins it there deliberately, after the implemented controls and
# their dated evidence. The claim was corrected on 2026-08-17 rather than left
# to be the first inaccuracy a security reviewer catches us in.)
#
# NOT IN SCOPE, and stated here so nobody spends an afternoon on one: a version
# banner, TLS configuration owned by the managed host, and any finding that
# requires an already-compromised operator credential. Also out of scope, and
# named because a header scanner will flag it within seconds: `script-src` on
# the cached marketing pages permits 'unsafe-inline'. That is known, deliberate
# and documented — a per-request nonce cannot exist on a document served from a
# CDN cache, and the routes that render per request, which is all of /app and
# both sign-in forms, do carry one. Tenant isolation IS in scope and is the
# finding we most want.