# Vurto Swap security contact, RFC 9116.
# Vurto is non-custodial and never holds funds, private keys or seed phrases.
# The findings we care most about: a route or spender that can move funds it was
# not approved for, anything that leaks a machine credential or a session, and
# any way to make a built transaction differ from the quote the user accepted.
#
# Coordinated disclosure, 90-day window: please keep a finding private until a fix is live
# or 90 days have passed from our acknowledgement, whichever comes first. If we need longer,
# we will tell you why and agree a new date with you.
#
# Safe harbour: research that follows the rules below is authorised, and we will not pursue
# legal action, involve law enforcement, or contact your host or employer. Stay in scope,
# stop at proof of concept, use only your own wallets and funds, never touch another user's
# data or session, never degrade the service, and report to us before anyone else. Do not
# spam the quote or build endpoints: they fan out to third-party aggregators that rate limit
# us, not you. Ask at the address below if you are unsure. A question asked in advance is
# always in bounds. This is our commitment and cannot bind an aggregator we route through.
#
# We do not run a paid bug bounty. Credit in the fix notes is offered to anyone who wants it.
Contact: mailto:security@vurto.cc
Canonical: https://swap.vurto.cc/.well-known/security.txt
Canonical: https://swap.vurto.cc/security.txt
Preferred-Languages: en, pt-BR
Expires: 2027-08-08T23:59:59.000Z