# Garag 1.0 - security contact / kontakt bezpieczeństwa
#
# Found a vulnerability? Write to the address below. We are a small team,
# so please give us the details in one message: the URL, the account or
# role you used, the steps, and what an attacker gets out of it.
#
# In scope: the production site and its API.
#   https://garag140.com
#
# Out of scope (please do not report and do not run):
#   - denial of service, load and stress testing, resource exhaustion;
#   - automated scanner output with no verified impact;
#   - anything against preview or staging deployments - they carry test
#     data and QA shortcuts, findings there are not product findings;
#   - other people's accounts and data. Use your own test accounts.
#
# What you get: a first reply within 72 hours. We fix what is real and
# will credit you if you want to be credited. There is no bug bounty -
# the project is self-funded and we would rather say so up front than
# imply a payout that is not coming.
#
# Please give us reasonable time to ship a fix before making the report
# public.

Contact: mailto:security@garag140.com
Expires: 2027-10-12T00:00:00Z
Preferred-Languages: pl, en, ru, uk
Canonical: https://garag140.com/.well-known/security.txt