# RFC 9116. Re-date Expires each year.

Contact: mailto:connect@avrascan.com
Contact: https://avrascan.com/security#reporting
Expires: 2027-09-18T00:00:00.000Z
Preferred-Languages: en, hi
Canonical: https://avrascan.com/.well-known/security.txt
Policy: https://avrascan.com/security#reporting

# We do not run a bug bounty. We would rather say so than let you spend a
# weekend expecting one.
#
# In scope:     avrascan.com and its subdomains, the console, the consumer
#               verdict pages, the public brand report links.
# Out of scope: our customers' own websites, our partners' own systems, the
#               payment gateways (report those to the gateway), and anything
#               requiring physical access to a print floor.
#
# Please do not run scanners against the consumer verdict path — a live scan
# burns a real buyer's verification. Ask and we will give you a sandbox tenant
# the same day.