# Lytly — security disclosure policy
# RFC 9116 — https://datatracker.ietf.org/doc/html/rfc9116
#
# If you've found a security issue in Lytly, the desktop app, the
# backend at api.lytly.app, the landing site, or the @LytlyBot
# Telegram bot — thank you. Please report it via the contact below
# rather than disclosing publicly first.

Contact: mailto:contact@lytly.app
Expires: 2027-05-09T00:00:00Z
Preferred-Languages: en, he, ru
Canonical: https://lytly.app/.well-known/security.txt
Policy: https://lytly.app/security-policy

# Acknowledgments live publicly with researcher consent at
#   https://lytly.app/security-acknowledgments
# A bug-bounty program does not exist yet (pre-revenue beta) — we
# acknowledge in writing and credit reporters; cash bounties are a
# post-v1.0 plan.