# AgentDrop Security Disclosure Policy
# RFC 9116 - https://www.rfc-editor.org/rfc/rfc9116
#
# We take security seriously. If you have discovered a vulnerability in
# AgentDrop's platform, SDKs, MCP server, or infrastructure, please report
# it via the contact below. We aim to acknowledge within 48 hours.
#
# In scope:
#   - agent-drop.com (web app, dashboard, /d/[id] download surface)
#   - api.agent-drop.com (REST + auth endpoints)
#   - docs.agent-drop.com (docs site)
#   - @agentdrop/sdk (npm), agentdrop (PyPI), @agentdrop/mcp-server (npm)
#
# Out of scope:
#   - Third-party services (Stripe, Supabase, Cloudflare, Vercel) - report directly to them
#   - Social engineering, phishing of staff
#   - Findings against staging or pre-production environments
#   - Reports requiring a privileged account you do not legitimately own

Contact: mailto:contact@agent-drop.com
Expires: 2027-05-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://agent-drop.com/.well-known/security.txt
Policy: https://agent-drop.com/legal/privacy