# inyourbrowser.com — Responsible Disclosure
# Reference: RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:inyourbrowser@protonmail.com
# Kept less than a year ahead (RFC 9116). Renew before 2027-08-01.
Expires: 2027-08-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://www.inyourbrowser.com/.well-known/security.txt
# Section 19 of the terms of service allows good-faith security research and
# sets its rules (own browser and data, no load tests, no access to accounts
# that are not yours, report before disclosing).
Policy: https://www.inyourbrowser.com/terms#security-research

# Scope
#
# inyourbrowser.com is a Next.js site of in-browser tools, hosted on Vercel.
# Every page is prerendered at build time and served as a static file,
# including the 404 page for addresses that match no page. The site's own
# code runs per request only for the /og social-card image, which draws a card
# from the title in its URL and never receives anything typed or dropped into
# a tool. All tool processing happens locally in the user's browser. There is
# no database, no user accounts, and no endpoint that accepts tool input.
#
# In-scope findings:
#   - Cross-site scripting (XSS) in any tool component
#   - Subresource integrity gaps that could lead to client-side compromise
#   - Information leaks from tools that should remain local-only
#   - CSP / security header misconfigurations
#   - Same-origin responses that could run attacker-influenced code without
#     the site's CSP
#   - Issues that could trick users into installing a manipulated PWA manifest
#   - Bypasses of the in-browser processing guarantee
#   - Ways a dependency, the build, or the deployment pipeline could change
#     what the site serves
#
# Out-of-scope (please do not report these):
#   - Missing email security records (SPF / DKIM / DMARC) on protonmail.com
#   - Best-practice header recommendations without a concrete exploit path
#   - Self-XSS that requires the user to paste attacker code into DevTools
#   - Vulnerabilities in Vercel's platform itself (please report those to
#     Vercel). Misconfiguration of this site's Vercel project, domain, DNS or
#     source repository is in scope.
#
# We do not run a paid bug bounty program. We do appreciate responsible reports
# and will acknowledge them by email within a reasonable time, as the terms of
# service (Section 19) also state.