# Yesterself — security contact information (RFC 9116)
# The sync server source will live at https://github.com/yesterself/yesterself-server;
# it is not public yet (blocker B-16), so this file does NOT advertise its security
# advisory form as a Contact. That URL 404s today, and an RFC 9116 Contact a reporter
# cannot reach is the same defect as the Encryption field below: it sends someone
# acting in good faith to a dead end and may lose the report entirely. The advisory
# Contact returns the day the repository is public, alongside the PGP key.
#
# Transcribed verbatim from 16-security-privacy.md §13.2, with one delta, stated
# rather than silent: §13.2 says the file is signed with a PGP key and carries a
# detached signature at .well-known/security.txt.sig. There is no key yet —
# generating it is a founder action; it is an identity, and it lives in a
# password manager rather than in a build — so this file is unsigned and no .sig
# is served. That is the still-open half of blocker B-2 in
# release/PUBLICATION-BLOCKERS.md. The Encryption field returns with the key.
#
# What changed on 2026-08-31 (the domain decision; amendment X-21 in 18 §10.3):
# the Contact mailbox was security@yesterself.app, which never delivered because
# that domain was never registered and now never will be. It is
# hello@khreshitech.solutions, which is monitored today. Every promise in the
# policy applies to it identically.

Contact: mailto:hello@khreshitech.solutions
Expires: 2027-06-30T23:59:59.000Z
Preferred-Languages: en
Canonical: https://yesterself.khreshitech.solutions/.well-known/security.txt
Policy: https://yesterself.khreshitech.solutions/disclosure.html
Acknowledgments: https://yesterself.khreshitech.solutions/disclosure.html#thanks