# Security policy for the Taiga documentation site (https://docs.tai.ga)
#
# Same policy, same contacts and same expiry as https://tai.ga -- this is not a
# second policy, it is the same one published on the host a researcher happens
# to be looking at. RFC 9116 is per-host: a finder on docs.tai.ga has no reason
# to try the apex, and "no security.txt here" is what makes people give up or
# post publicly instead.
#
# Both locations are listed under Canonical below, so either can be recognised
# as authoritative for this file.
#
# Expires is deliberately the SAME instant as the apex file. Two dates would be
# two things to remember, and the second one would be the one that lapses. CI
# fails before this date arrives -- see the `securitytxt` check in
# apps/docs/scripts/check-claims.py -- because an expired security.txt is
# treated as invalid by tooling, and a report that is never delivered is the
# whole failure this file exists to prevent.

Contact: mailto:security@tai.ga
Contact: mailto:teemu.ijas@tai.ga
Policy: https://tai.ga/en/trust/vulnerability-disclosure/
Preferred-Languages: en, fi
Canonical: https://docs.tai.ga/.well-known/security.txt
Canonical: https://tai.ga/.well-known/security.txt
Expires: 2027-03-25T00:00:00.000Z