# security.txt — https://www.rfc-editor.org/rfc/rfc9116
# A defined reporting path exists because unsolicited "beg bounty" mail already
# arrives; routing it here keeps real reports separate from the noise.

Contact: mailto:security@invoice-api.xhub.io
Expires: 2027-08-08T00:00:00.000Z
Preferred-Languages: de, en
Canonical: https://invoice-api.xhub.io/.well-known/security.txt
Policy: https://invoice-api.xhub.io/security

# We reply to substantiated reports within 24 hours on business days.
# We do not operate a paid bug bounty; please do not send invoices.