# HaulGuard AI — Security Disclosure Policy
# Canonical: https://haulguard.ai/.well-known/security.txt
# RFC 9116 (https://datatracker.ietf.org/doc/html/rfc9116)
#
# We're a small founder-led company (one operator, no security team).
# If you've found something that could harm our users, our drivers,
# the integrity of our audit chain, or the regulatory data we publish,
# please tell us. We will read your message, fix what we can quickly,
# and credit you publicly if you'd like that.

Contact: https://haulguard.ai/contact
Contact: mailto:security@haulguard.ai
Expires: 2027-05-22T00:00:00.000Z
Preferred-Languages: en
Canonical: https://haulguard.ai/.well-known/security.txt
Policy: https://haulguard.ai/contact

# Disclosure expectations
#
# - Please include "[security]" in the subject of any email disclosure
#   so it doesn't get triaged with general inbound.
# - Please give us a reasonable window to fix before public disclosure;
#   90 days is the standard floor. For anything affecting the audit
#   chain's integrity claim, please reach out before public posting.
# - We will not pursue legal action against good-faith researchers
#   who follow this policy.
# - There is no formal bounty program yet, but we're happy to provide
#   public acknowledgment, swag, and a recommendation letter where
#   useful.
#
# What we care about most (in rough priority order)
#
# 1. Audit-chain integrity: anything that lets an attacker silently
#    modify, insert, or delete events in data/audit-ledger.json or
#    forge the SHA-256 hash chain.
# 2. Driver-data leakage: any path that exposes CDL fields, scan
#    payloads, or per-tester data across ownership boundaries.
# 3. Auth bypass: ADMIN_CODE compromise, session-cookie forgery,
#    geo-block evasion (we are US-only beta), IDOR on /api/scan/:id
#    endpoints.
# 4. Public verifier bypass: the /verify page renders SHA-256
#    verification client-side; any way to make a tampered chain
#    render as ✓ is a critical bug.
# 5. SSRF / credential leakage: Anthropic key, Stripe key, Azure
#    service keys, SMTP credentials are environment variables only;
#    please report any way these reach an attacker.
#
# Not in scope (please don't spend your time on these)
#
# - Missing security headers on the public marketing pages (we know;
#   the API surface is locked down separately)
# - Self-XSS that requires the attacker to type into their own console
# - DoS via legitimate-rate-limit exhaustion
# - Third-party services we depend on (Microsoft Azure, Anthropic,
#   Stripe, Google Workspace, among others) — please report directly
#   to them
#
# Thanks for taking the time. — Zack Foster, Founder