# AssureMesh security disclosure information.
# Published per RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116).
#
# If you believe you have found a security vulnerability in AssureMesh,
# please email the address below. We will acknowledge receipt within
# 3 business days and provide an initial triage decision within
# 10 business days. We will not pursue legal action against good-faith
# researchers who follow the disclosure process at https://assuremesh.com/security.html.
#
# AssureMesh release artifacts are signed using Sigstore keyless signing
# via GitHub OIDC. There is no long-lived AssureMesh signing key to fetch
# or pin. Customers verify with `cosign verify-blob` against the
# certificate identity documented at https://assuremesh.com/security.html and
# in the release notes. See also: https://www.sigstore.dev.

Contact: mailto:security@assuremesh.com
Expires: 2027-06-22T00:00:00Z
Preferred-Languages: en
Canonical: https://assuremesh.com/.well-known/security.txt
Policy: https://assuremesh.com/security.html