# ╔══════════════════════════════════════════════════════════════════════════════╗
# ║                                                                              ║
# ║   ██╗    ██╗██╗   ██╗██████╗ ██╗   ██╗███████╗                               ║
# ║   ██║    ██║██║   ██║██╔══██╗██║   ██║██╔════╝                               ║
# ║   ██║ █╗ ██║██║   ██║██████╔╝██║   ██║███████╗                               ║
# ║   ██║███╗██║██║   ██║██╔══██╗██║   ██║╚════██║                               ║
# ║   ╚███╔███╔╝╚██████╔╝██║  ██║╚██████╔╝███████║                               ║
# ║    ╚══╝╚══╝  ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚══════╝                               ║
# ║                                                                              ║
# ║   BY FUTURIZE — All-in-One African Billing, Inventory & POS Platform         ║
# ║   Vulnerability disclosure · RFC 9116                                        ║
# ║                                                                              ║
# ╚══════════════════════════════════════════════════════════════════════════════╝
#
# Hello, and thank you for coming this far.
#
# WURUS keeps the books, the stock, the till and the payroll of real businesses.
# A flaw here is somebody's revenue, their customer list, their payslips. If you
# have found one, you are doing us a favour — and we answer accordingly.
#
#   📬  Write to security@wurus.app. A human reads that inbox.
#   ⏱   Acknowledged within 3 business days, triaged within 10.
#   📖  The rules of engagement live at the address given by `Policy:`
#       below. They are one page, in English and French.
#   🙏  No financial reward TODAY, and we would rather write that down than
#       let you hope for one. This is not a matter of principle, it is a
#       matter of cash: we are a young company.
#
#       We commit to opening a reward programme — material or financial —
#       once we reach profitability or close a funding round. Researchers
#       who report to us before that date will not be forgotten when it
#       opens.
#
#       Until then, what we offer is smaller and we stand by it: a fast
#       reply written by someone who understands the subject, a fix, and
#       your name in our hall of fame if you want one.
#
# ------------------------------------------------------------------------------

Contact: mailto:security@wurus.app
Expires: 2027-09-10T23:59:59.000Z
Preferred-Languages: en, fr
Policy: https://wurus.app/page/politique-de-divulgation
Canonical: https://wurus.app/.well-known/security.txt

# ------------------------------------------------------------------------------
#  TWO THINGS WORTH KNOWING BEFORE YOU WRITE
# ------------------------------------------------------------------------------
#
#  WE HAVE NO PGP KEY
#  You will not find an `Encryption:` field above, because we publish no key.
#  An `Encryption:` pointing at a key that does not exist would be exactly the
#  404 this file exists to prevent.
#
#  So write to us in the clear — but put NO customer data in the body of the
#  message. If your proof-of-concept contains any, tell us and we will agree on
#  a channel before you send it.
#
#  THE `Expires` DATE IS SHORT ON PURPOSE
#  A mailbox always ends up closed, forwarded, or read by nobody. An expired
#  security.txt advertises a DEAD channel, which is worse than no file at all:
#  you believe you have warned someone, and no one reads it. We only push this
#  date out after checking that a human still reads the address.
#
# ------------------------------------------------------------------------------