# Scienter — security contact, per RFC 9116.
#
# Report at https://scienter.xyz/security/bug-bounty. That page is the
# authoritative document: scope, safe harbour, severity tiers and response
# times, and it states the current condition of this intake rather than
# assuming it.
#
# ON THE ADDRESS BELOW
#
# An earlier version of this file said the scienter.xyz zone published no MX
# records and that mail here was refused at the recipient-domain lookup. That
# was true when written (verified 2026-09-01) and is no longer: the zone now
# publishes three MX records on Cloudflare Email Routing, confirmed against
# two independent resolvers on 2026-09-24.
#
# iliya@scienter.xyz is the address confirmed to receive, by sending to it and
# reading it. It is listed first for that reason. security@scienter.xyz is
# listed second because it is the address this project intends to answer on,
# and routing for it has not been confirmed the same way — so if a report
# matters, use the first address or the page.
#
# A researcher who sends a real finding into a mailbox that does not exist
# sees no bounce for hours, assumes it landed, and starts a disclosure clock
# against nothing. Saying which address is proven is worth more than listing
# a tidier one.

Contact: mailto:iliya@scienter.xyz
Contact: mailto:security@scienter.xyz
Contact: https://scienter.xyz/security/bug-bounty
Expires: 2027-09-03T00:00:00.000Z
Preferred-Languages: en
Canonical: https://scienter.xyz/.well-known/security.txt
Policy: https://scienter.xyz/security/bug-bounty