# RFC 9116. A security researcher looks here first, so this is where the
# contact lives rather than only on a legal page.
Contact: mailto:legal@handshakemd.com
Contact: https://handshakemd.com/legal/notices/#s15-security-reports
Expires: 2027-08-31T00:00:00.000Z
Preferred-Languages: en
Canonical: https://handshakemd.com/.well-known/security.txt
Policy: https://handshakemd.com/legal/notices/#s15-security-reports

# What we ask. Tell us before you tell the world, and give us a reasonable
# chance to fix it. We will not threaten anybody who reports something in good
# faith, and we will tell you what we did about it.
#
# What not to do while testing: reach another user's listing, obtain patient
# information, damage data, run denial of service tests, or send malware. There
# are no passwords on this site and no patient records in it, which should make
# staying inside those lines straightforward.