# Security Policy for LLMS Config
# Contact: Security Team
# Last Updated: January 21, 2026
# Expires: January 21, 2027
# Encoding: utf-8

# ============================================================================
# CONTACT INFORMATION
# ============================================================================

# Primary security contact email
Contact: mailto:security@llmsconfig.com

# Security disclosure page (preferred method)
Contact: https://llmsconfig.com/security

# Encryption key for sensitive disclosures
Key: https://llmsconfig.com/security/pgp-key.txt

# ============================================================================
# SECURITY POLICY
# ============================================================================

# Our security disclosure policy
Policy: https://llmsconfig.com/security-policy

# We accept security reports in English
Preferred-Languages: en, es

# ============================================================================
# ACKNOWLEDGEMENTS
# ============================================================================

# Security researchers who have helped improve our security
Acknowledgements: https://llmsconfig.com/security-hall-of-fame

# ============================================================================
# SECURITY STATUS
# ============================================================================

# Current security status
Status: https://llmsconfig.com/status

# ============================================================================
# SECURITY TEAM
# ============================================================================

# Security team members
# Team: John Doe (Security Lead)
# Team: Jane Smith (Security Engineer)

# ============================================================================
# SECURITY POLICY SUMMARY
# ============================================================================
#
# We take security seriously and value the security research community.
#
# REPORTING VULNERABILITIES:
# 1. Email security@llmsconfig.com (or use PGP key for sensitive matters)
# 2. Include detailed description, steps to reproduce, and impact assessment
# 3. Allow us 14 days to respond and 90 days to fix before public disclosure
#
# SAFE HARBOR:
# - Research conducted in good faith is protected
# - We will not pursue legal action if you follow this policy
# - We will credit you in our Security Hall of Fame
#
# WHAT WE TEST:
# - Authentication and authorization vulnerabilities
# - Injection attacks (XSS, SQL injection, etc.)
# - Server-side request forgery (SSRF)
# - Business logic vulnerabilities
# - Sensitive data exposure
#
# WHAT WE DON'T TEST:
# - DDoS attacks
# - Social engineering
# - Physical security
# - Third-party dependencies (unless directly exploitable)
#
# SCOPE:
# - In scope: *.llmsconfig.com
# - Out of scope: Third-party services, user-generated content
#
# REWARDS:
# - Bounties: $100-$10,000 USD depending on severity
# - Swag: T-shirts and stickers for all valid reports
# - Hall of Fame: Public recognition for qualifying researchers
#
# ============================================================================
# SECURITY ARCHITECTURE
# ============================================================================
#
# Authentication: Clerk (OAuth 2.0, multi-factor supported)
# Backend: Convex (server-side data storage, row-level security)
# API Security: Rate limiting, input validation, authentication required
# Data Protection: AES-256 encryption at rest, TLS 1.3 in transit
# Monitoring: Automated security scanning, error tracking with Sentry
#
# ============================================================================
# COMPLIANCE
# ============================================================================
#
# - GDPR compliant data handling
# - CCPA compliant privacy practices
# - SOC 2 Type II compliant (in progress)
# - Regular security audits and penetration testing
#
# ============================================================================
# INCIDENT RESPONSE
# ============================================================================
#
# Our incident response team is available 24/7 for critical security issues.
#
# Severity Levels:
# - Critical: Production data exposure, authentication bypass
# - High: Significant data leak, privilege escalation
# - Medium: Limited data exposure, minor bypass
# - Low: Information disclosure, best practice violations
#
# Response Times:
# - Critical: 4 hours
# - High: 1 business day
# - Medium: 2 business days
# - Low: 5 business days
#
# ============================================================================
# SECURITY BEST PRACTICES
# ============================================================================
#
# We follow industry best practices including:
# - OWASP Top 10 mitigation
# - Regular dependency updates
# - Automated security scanning
# - Bug bounty program
# - Security training for all engineers
# - Secure development lifecycle (SDLC)
#
# ============================================================================
# ADDITIONAL RESOURCES
# ============================================================================
#
# Security Documentation: https://llmsconfig.com/docs/security
# Privacy Policy: https://llmsconfig.com/privacy
# Terms of Service: https://llmsconfig.com/terms
# API Documentation: https://llmsconfig.com/docs/api
#
# ============================================================================
# CHANGE HISTORY
# ============================================================================
#
# 2026-01-21: Initial security.txt file created
#
# ============================================================================