# MS TICKS Security Policy
# https://msticks.pk/.well-known/security.txt
# Compliant with RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)

Contact: mailto:support@msticks.pk
Expires: 2027-07-06T00:00:00.000Z
Canonical: https://msticks.pk/.well-known/security.txt
Preferred-Languages: en
Policy: https://msticks.pk/security-policy

# ── Scope ────────────────────────────────────────────────────────────────────
# In scope:  https://msticks.pk
# Out of scope: third-party services (Resend, AWS S3, Stripe)

# ── Responsible Disclosure ───────────────────────────────────────────────────
# We request that you:
# - Give us reasonable time (90 days) to remediate before public disclosure
# - Do not access, modify, or delete user data
# - Do not disrupt production services
# - Do not perform social engineering against our team or customers

# ── What to Report ───────────────────────────────────────────────────────────
# Please report any security issues including but not limited to:
# - Authentication/authorization bypasses
# - Injection vulnerabilities (SQL, XSS, command injection)
# - Sensitive data exposure
# - Insecure direct object references
# - Business logic flaws affecting orders or payments