# Terminal — security contact (RFC 9116)
# Served at https://www.stantonanalytica.com/.well-known/security.txt
#
# CONTACT ORDER IS PREFERENCE ORDER, and the first one has to WORK.
# This file listed only the mailto: below, on a domain that did not resolve — so a
# researcher following RFC 9116 reached nobody, while SECURITY.md said the working
# channel was a GitHub advisory. Two files, one claim, and they disagreed. The advisory
# URL went first because it was the only one that was live.
#
# 2026-09-17, and it took all three steps to become true: stantonanalytica.com was bought,
# the site moved onto it, and Cloudflare Email Routing was pointed at the owner's inbox.
# OWNING A DOMAIN IS NOT A MAILBOX — between the second step and the third, mail to this
# address was REFUSED at the edge (550 5.1.1 Address does not exist), which is precisely
# the state this note existed to stop anyone publishing as though it worked. The mailto:
# moved to the front only after a test message was actually RECEIVED, not when the records
# looked right. AUDIT F-003 closes with it.

Contact: mailto:admin@stantonanalytica.com
Contact: https://github.com/tateolsenn/Stanton-Terminal/security/advisories/new
Expires: 2027-08-21T00:00:00.000Z
Preferred-Languages: en
Canonical: https://www.stantonanalytica.com/.well-known/security.txt

# Scope notes for anyone reporting:
#
# Terminal is local-first. Trade data lives in the browser's IndexedDB and is never
# sent anywhere by default. The serverless endpoints under /api are optional and OFF
# until the operator configures them:
#   /api/db          cloud sync to the operator's Supabase Postgres database (end-to-end
#                    encrypted when a passphrase is set; the server stores one opaque envelope)
#   /api/chain       a read-only options-chain relay, rate limited per IP
#   /api/push        Web Push subscribe/sync for price alerts; /api/check-alerts is its cron
#   /api/relay       fetch of an allow-listed public feed (and /api/warm-relay, its cron)
#   /api/stream      one shared upstream quote socket, fanned out as server-sent events
#   /api/keys        which provider keys the deployment holds, as booleans
#   /api/promo       promo-code redemption on the signed-in account
# SECURITY.md in the repository says what is in scope for each.
#
# Sign-in is Supabase Auth (2026-09-02): every /api/db row is scoped to the signed-in
# user, so there IS multi-tenant data behind that door. Payments are sold on the
# landing page (/) but no payment path exists in the code yet — a checkout that
# appears here before this note changes is out of scope and worth a report.