# https://www.rfc-editor.org/rfc/rfc9116
#
# The marketing site is where a vendor security reviewer looks first, so the file lives
# here as well as on the product origin. Keep Expires in the future — an expired
# security.txt reads as an abandoned process, which is worse than not having one.

# Both origins are listed, and both files list both.
#
# RFC 9116 §2.5.2: when the file is served from more than one location, every Canonical URI
# it is served at should appear in it. The two copies previously named one origin each — the
# marketing site claimed kronikl.io, the product claimed kronikl.dev — so each file said the
# other was not canonical. To a reviewer comparing them that is a company that does not know
# which of its own domains is authoritative, and it is the first thing they compare.

Contact: mailto:security@kronikl.dev
Contact: https://github.com/kronikl/kronikl/security/advisories/new
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://kronikl.io/.well-known/security.txt
Canonical: https://kronikl.dev/.well-known/security.txt
Policy: https://github.com/kronikl/kronikl/blob/main/SECURITY.md