# https://www.rfc-editor.org/rfc/rfc9116 — served from apps/web/static/, so it is reachable at
# https://<DOMAIN>/.well-known/security.txt with no route file.
#
# Expires MUST stay less than a year out; `scripts/alerts.sh` warns 30 days before it lapses and
# docs/ci-gates.md names the review as part of the quarterly security round.
Contact: mailto:security@angelsquad.example
Expires: 2027-06-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://angelsquad.example/.well-known/security.txt
Policy: https://angelsquad.example/security