# Security Policy for AgentsKB/SuperNode
# Format: RFC 9116 (https://securitytxt.org/)
# Last Updated: 2025-11-09

Contact: mailto:security@agentskb.com
Contact: https://agentskb.com/security
Expires: 2026-11-09T00:00:00.000Z
Encryption: https://agentskb.com/.well-known/pgp-key.txt
Preferred-Languages: en
Canonical: https://agentskb.com/.well-known/security.txt

# Vulnerability Disclosure Policy
Policy: https://agentskb.com/security#vulnerability-reporting

# Security Documentation
Policy: https://github.com/agentskb/agentskb/blob/main/SECURITY.md

# Acknowledgments
Acknowledgments: https://agentskb.com/security#hall-of-fame

# Security Scope
# In-scope:
# - REST API (https://supernode-discovery-api.fly.dev)
# - MCP Server (https://supernode-mcp.fly.dev)
# - Frontend (https://agentskb.com)
# - Database security
# - Authentication & authorization (when implemented)
#
# Out-of-scope:
# - Social engineering
# - Physical security
# - Third-party services (unless directly exploitable through SUPERNODE)

# Reporting Instructions
# 1. DO NOT open public GitHub issues for security vulnerabilities
# 2. Email security@agentskb.com with:
#    - Detailed description
#    - Steps to reproduce
#    - Impact assessment
#    - Proof of concept (if available)
# 3. Allow 90 days for patch before public disclosure
# 4. Use PGP encryption for sensitive reports

# Response Timeline
# - 24 hours: Initial response
# - 7 days: Vulnerability validation
# - 30 days: Patch developed and tested
# - 90 days: Public disclosure (if not fixed sooner)

# Severity Levels
# - Critical: Remote code execution, data breach (24h response)
# - High: Privilege escalation, SQL injection (7d response)
# - Medium: Information disclosure, CSRF (30d response)
# - Low: Minor issues (90d response)

# Bug Bounty
# Status: Not currently active
# Expected: Q2 2026

# Hall of Fame
# Security researchers who responsibly disclosed vulnerabilities
# will be listed at: https://agentskb.com/security#hall-of-fame