Safe harbor
Good-faith reports that avoid data exfiltration, service disruption, persistence, and social engineering will be reviewed constructively.
Responsible disclosure
Report security issues to security@boetica.ai.
This policy covers the public marketing site and Boetica-hosted product surfaces. Do not test customer repositories, third-party accounts, or data you do not own.
What to send
Include affected URL, steps to reproduce, impact, timestamp, and your preferred contact details. Do not include secrets in the report.
What not to test
Do not access customer repositories, third-party accounts, production secrets, payment systems, or data you do not own. Stop testing if you encounter sensitive data.
Encryption
Use the Boetica security public key at /pgp.txt for sensitive report details. The key fingerprint is 5D00 061E BD14 25D6 DF39 5912 67B4 380C BA78 0FD6.
Response standard
Valid reports should receive acknowledgement, triage, remediation status, and closure notes. Public disclosure timing is coordinated case by case.
Machine-readable policy
The security contact is available at /.well-known/security.txt.