# Morph Security Policy
# RFC 9116: https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:security@morph.cool
Expires: 2027-04-23T23:59:59.000Z
Preferred-Languages: en
Canonical: https://morph.cool/.well-known/security.txt
Policy: https://morph.cool/privacy

# If you have discovered a security vulnerability in Morph, please email
# security@morph.cool. We respond within 5 business days.
#
# Morph runs client-side (WebAssembly + JavaScript) — no user files are
# uploaded. Our attack surface:
#   - morph.cool — Cloudflare Pages (static + SPA)
#   - api.morph.cool — Cloudflare Workers (auth, leaderboard, conversion tracking)
#
# Please do not:
#   - Run automated scanners that generate meaningful load
#   - Test against live user accounts other than your own
#   - Disclose publicly before we have had a reasonable window to fix