# RFC 9116. If you have found a vulnerability in kineticworkoutapp.com, the
# Kinetic iPhone app, or the Supabase backend behind them, this is where to
# send it.
#
# This file lives at /security.txt and is rewritten to the canonical
# /.well-known/security.txt in vercel.json. It is kept out of a dot-directory
# on purpose: whether a static host serves dotfiles is not guaranteed, and a
# security contact that silently 404s is worse than none. One file, two paths,
# no copy to drift.

Contact: mailto:s7venturecapital@gmail.com
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://kineticworkoutapp.com/.well-known/security.txt
Policy: https://kineticworkoutapp.com/support

# What we ask
#
# Give us a way to reproduce it, and give us time to fix it before it is
# public. Do not run automated scanners against production, do not access,
# alter or retain another person's training data, and do not degrade the
# service for people mid-workout. Testing against your own account is fine and
# encouraged.
#
# Particularly interested in: row-level security bypasses on any kinetic_*
# table, anything that lets one account read another's sessions, sets, filmed
# clips or progress photos, and anything that exposes a service-role key.
#
# We are a very small team. You will get a human reply, not a ticket number.