# VocalIA security disclosure policy
# Format: RFC 9116 https://www.rfc-editor.org/rfc/rfc9116
# Last-Updated: 2026-05-17

Contact: mailto:security@vocalia.ma
Contact: https://vocalia.ma/contact

Expires: 2027-05-17T00:00:00.000Z

Encryption: https://vocalia.ma/.well-known/pgp-key.txt

Preferred-Languages: fr, en

Canonical: https://vocalia.ma/.well-known/security.txt

Policy: https://vocalia.ma/privacy
Acknowledgments: https://vocalia.ma/about

# ---------------------------------------------------------------------------
# Scope
# ---------------------------------------------------------------------------
# In scope :
#   - vocalia.ma (production website + static assets)
#   - api.vocalia.ma (Hostinger VPS production API)
#   - The Voice Widget B2B / E-commerce client-side scripts loaded from vocalia.ma
#
# Out of scope :
#   - Third-party integrations (Stripe, Twilio, ElevenLabs, Supabase, Plausible)
#     — please report directly to the upstream provider security teams.
#   - Tenant white-label deployments hosted on tenant domains.
#
# Severity priority (highest first) :
#   1. Tenant data isolation breaches (cross-tenant leakage)
#   2. Authentication/authorization bypass on /app/* dashboards
#   3. Stripe billing chain integrity issues
#   4. PII / GDPR-relevant data exposures
#   5. XSS / CSRF on user-input forms
#   6. SSRF / SQL injection (less likely given architecture)
#   7. Denial-of-service / rate-limit bypass
#   8. Information disclosure (version banners, stack traces)
#
# Disclosure process :
#   - Initial acknowledgment within 5 business days
#   - Triage + patch timeline communicated within 14 business days
#   - Coordinated disclosure preferred ; 90-day default embargo
#   - CVE coordination via security@vocalia.ma if applicable
#
# Bounty :
#   - No paid bug bounty program at present
#   - Acknowledgment in the about page is offered for high-quality reports