# Nyquist security.txt — RFC 9116 compliant
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:security@nyquist.pro
Expires: 2027-04-29T00:00:00.000Z
Preferred-Languages: en, ru
Canonical: https://nyquist.pro/.well-known/security.txt
Policy: https://nyquist.pro/security/disclosure-policy

# Scope
# - api.nyquist.pro (FastAPI backend, all /api/* endpoints)
# - nyquist.pro (Vue SPA frontend)
# - *.nyquist.pro (Telegram WebApp, admin portal, marketing landing)

# Acknowledgments
# We gratefully acknowledge security researchers who responsibly disclose
# vulnerabilities. Public acknowledgment at:
#   https://nyquist.pro/security/hall-of-fame
# (after issue is fixed + public disclosure agreed)

# Out of scope (do not report)
# - DoS / DDoS findings on public endpoints
# - Rate-limit bypass via headers (we already rate-limit by IP)
# - Missing SPF/DKIM/DMARC on non-production email domains
# - Self-XSS (XSS that requires victim to paste hostile JS)
# - CSV injection in user-downloaded exports
# - CSP-report-uri / iframe busting with no functional impact
# - Third-party dependencies' published CVEs without reproducible exploit
#   (we track via Dependabot; duplicates will be closed)