# Agent Einstein — security contact (RFC 9116)
#
# Anthropic's Software Directory Terms require a mechanism for receiving and
# investigating vulnerability reports; ChatGPT's app review asks the same. This
# file is that mechanism, and it is the ONLY published address that has to work
# — so it points at a mailbox with real MX records, not at the apex domain
# (emc2ai.io publishes no MX and every address on it bounces).

Contact: mailto:ainstein1@outlook.com
Expires: 2027-08-27T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://emc2ai.io/.well-known/security.txt
Policy: https://emc2ai.io/terms-of-services/

# Scope: emc2ai.io, the MCP connector at https://emc2ai.io/api/mcp, and the
# public distribution repos github.com/ChuXo/einstein-claude-plugin and
# github.com/ChuXo/einstein-gemini-extension.
#
# Please include reproduction steps. We acknowledge reports within 5 working
# days. Do not run automated scans against the paid rails — the free tools at
# /api/mcp are anonymous and unmetered, and are the right surface to test on.