# Digital Umbrella: how to report a security problem
#
# RFC 9116. If you have found a vulnerability in digitalumbrella.io, in the
# sign-in at app.digitalumbrella.io, or in any product it opens (TNA,
# Blueprint, Workmap), write to the address below. You will get a
# human reply.
#
# We would rather hear about a problem early and awkwardly than read about it
# later, and we will not threaten anyone who reports one in good faith.

# Deliberately the address the site already publishes, rather than a dedicated
# security@ alias. An unrouted security contact is worse than none: the report
# bounces, the reporter concludes nobody is listening, and the next one goes
# somewhere public instead. Switch this to security@ once that mailbox is
# confirmed to route to a person.
Contact: mailto:hello@digitalumbrella.io
Expires: 2027-08-23T00:00:00.000Z
Preferred-Languages: en, ar
Canonical: https://digitalumbrella.io/.well-known/security.txt

# What helps us act quickly: the URL or endpoint, what you did, what happened,
# and roughly when. A proof of concept is welcome but never required.
#
# Please do not run automated scanners against the production applications, and
# please do not access, modify or retain data belonging to another customer.
# The products are multi-tenant and hold our customers' commercial information.
# If a proof of concept would require that, tell us instead and we will arrange
# a test tenant.
#
# We aim to acknowledge within one business day and to tell you what we did.