# GChat — security contacts & disclosure policy
# RFC 9116 — https://securitytxt.org/

Contact: mailto:security@gchat.tech
Expires: 2027-01-01T00:00:00Z
Preferred-Languages: en, ru
Canonical: https://gchat.tech/.well-known/security.txt
Policy: https://gchat.tech/en/security/
Acknowledgments: https://gchat.tech/en/security/#acknowledgments

# Scope
# ------
# * gchat.app and all subdomains
# * GChat mobile clients (iOS, Android)
# * The GChat protocol (X3DH + Double Ratchet wiring, wire format)
#
# Out of scope
# ------------
# * Third-party hosting providers (please report upstream)
# * Social-engineering of GChat team members
#
# Reporting
# ---------
# Please email security@gchat.app with technical detail. PGP keys may be
# rotated from time to time and will be published at
# https://gchat.app/.well-known/pgp.asc. We aim to acknowledge within 3
# business days and to resolve or publicly disclose within 90 days.
#
# We will not take legal action against good-faith researchers who:
#   - Stay within the scope defined above;
#   - Avoid privacy violations, service degradation, or destructive testing;
#   - Give us reasonable time to respond before public disclosure.