# Duress EVAC — responsible disclosure. Report a security issue to the contact
# below and we will work it in good faith; we will not pursue researchers who
# act responsibly and give us reasonable time to remediate.
Contact: mailto:security@duress.com
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
# DOMAIN TO SWAP: the two URLs below point at the current mock deployment
# (duress-evac.pages.dev). When the real canonical host is known, replace
# `duress-evac.pages.dev` in BOTH lines with that host. See web/docs/verifier-url.md.
# The real domain is not invented here — this is the single place to change it.
Canonical: https://duress-evac.pages.dev/.well-known/security.txt
Policy: https://duress-evac.pages.dev/trust.html