# Security policy for FX Forge (terminal) and RateCheck (consumer Checker).
# Entity: James Kniveton (sole trader), ABN 70 223 295 749
# See RFC 9116 for the format spec — https://datatracker.ietf.org/doc/html/rfc9116
#
# Status (updated 2026-06-26): contact + canonical domain are finalised on
# fxforge.co (connect@fxforge.co per the 25/06 domain ADR) and Expires is set
# to a future date. Remaining before public launch:
#   1. Confirm connect@fxforge.co is a live, monitored inbox.
#   2. Add a PGP key + PGP-signed security.txt (/security.txt.sig) and
#      reference the key via an Encryption: line below.
#   3. Refresh Expires on each renewal cycle.

Contact: mailto:connect@fxforge.co
Expires: 2027-05-29T00:00:00.000Z
Preferred-Languages: en
Canonical: https://fxforge.co/.well-known/security.txt
Policy: https://fxforge.co/checker/security
Acknowledgments: https://fxforge.co/checker/security#thanks

# Out of scope at concept stage:
#   - Vulnerabilities in the demo/preview UI that require user interaction
#     unlikely outside an internal test (e.g. self-XSS via paste).
#   - Findings against third-party upstream APIs (Frankfurter, FMP, FRED,
#     Anthropic, Supabase, Stripe). Report those upstream.
#   - Rate-limiting / DoS concerns against the demo deployment.
#
# In scope:
#   - Stored or reflected XSS in any FX Forge property.
#   - Authentication / authorization bypass.
#   - Server-side request forgery via any /api/* route.
#   - CSP / CORS / cookie configuration weakness.
#   - Anything that exposes another user's data.