# VETR Framework — security contact (RFC 9116)
# Found a vulnerability? We acknowledge valid reports within 48 hours and work
# with researchers in good faith. No lawyers, no surprises.
#
# Known and intentional: OAuth client registration (POST /oauth/register, RFC 7591) is open on purpose, because AI assistants such
# as Claude and ChatGPT register themselves in order to connect. It is protected by design: PKCE (S256) is required, redirect
# addresses are matched exactly (on a loopback address any port is accepted, RFC 8252), every connection needs a signed-in person to
# approve a consent screen that names the destination and says the app is not verified, and registration is rate-limited. A report that only says "registration needs no
# authentication" is out of scope. A way AROUND any of those protections is very much in scope: please send it.
Contact: mailto:security@vetrproposal.com
Expires: 2027-06-26T23:59:59.000Z
Policy: https://vetrproposal.com/security
Preferred-Languages: en
Canonical: https://vetrproposal.com/.well-known/security.txt