Contact: mailto:security@citadelexchange.io
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, fr, fr-CA, es
Canonical: /.well-known/security.txt
Policy: /trust
Acknowledgments: /trust#disclosure
# Coordinated disclosure: we acknowledge reports within 2 business days.
# In scope: authentication, access control / tenant-room isolation bypass,
# key-handling flaws, and related application security issues.
# Out of scope: reports that require a compromised end-user device, since the
# platform is zero-knowledge and cannot protect an attacker-controlled client.
# Mailbox must stay monitored (go/no-go § B6). Update Contact if the domain changes.