# ===========================================================================
#  security.txt — RFC 9116
#  Served at https://YOUR-DOMAIN/.well-known/security.txt
#
#  >>> OPERATOR: every line marked REPLACE-ME below must be edited before   <<<
#  >>> go-live. An unedited security.txt is worse than none at all: it      <<<
#  >>> advertises a reporting channel that silently discards reports.       <<<
#
#  The .htaccess dotfile rule (RedirectMatch 404 (?i)/\.(?!well-known/))
#  deliberately exempts /.well-known/ so this file stays reachable.
# ===========================================================================

# REPLACE-ME — a mailbox that a human actually monitors. A role address is
# strongly preferred over a personal one so reports survive staff changes.
Contact: mailto:contact@orikin.ai

# REPLACE-ME — optional but useful: a second channel in case mail bounces.
Contact: https://orikin.ai/talk-to-us.html

# RFC 9116 REQUIRES this field, and requires that it be in the future.
# Keep it under a year out and set a calendar reminder to roll it forward —
# an expired security.txt is treated as unmaintained and ignored by reporters.
Expires: 2027-07-29T00:00:00.000Z

# REPLACE-ME — must be the exact HTTPS URL this file is served from, including
# the canonical host. Since .htaccess collapses www -> apex, use the APEX form.
# A mismatch here lets an attacker who can host a file claim your disclosure
# channel, so it is a security control, not metadata.
Canonical: https://orikin.ai/.well-known/security.txt

Preferred-Languages: en

# OPTIONAL — uncomment once the corresponding pages exist. Do not point at
# URLs you have not created.
# Policy: https://orikin.ai/security-policy.html
# Acknowledgments: https://orikin.ai/security-thanks.html
# Encryption: https://orikin.ai/.well-known/pgp-key.txt

# ---------------------------------------------------------------------------
# Scope note for reporters (comments are ignored by parsers, read by humans):
# This is a static marketing site. The only server-side code is /contact.php.
# All figures, dashboards, customer names and case-study details shown on the
# site are illustrative, not real customer data.
# ---------------------------------------------------------------------------