# TODO: replace <domain-placeholder> with the production canonical domain
# (likely `tagvault.brikbond.com`) once DNS resolves and the
# `security@<domain-placeholder>` mailbox is provisioned. Until then, this
# file announces a non-resolvable contact — scanners will still find it,
# but inbound reports route nowhere.
#
# Reference: RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116). Mirrored
# upstream policy at /SECURITY.md and the GitHub canonical SECURITY.md.

Contact: mailto:security@<domain-placeholder>
Expires: 2027-12-31T23:59:59.000Z
Acknowledgments: https://<domain-placeholder>/security
Preferred-Languages: en
Canonical: https://<domain-placeholder>/.well-known/security.txt
Policy: https://github.com/vtagsoftwaresolutions-admin/tag-vault/blob/main/SECURITY.md