# FaithKit — security disclosure (RFC 9116)
# https://faithkit.org — a church website you own. Free, open source (AGPL v3).

Contact: mailto:hello@faithkit.org
Expires: 2027-09-12T00:00:00.000Z
Canonical: https://faithkit.org/.well-known/security.txt
Preferred-Languages: en

# In scope
#   faithkit.org — the marketing site, the Journal, the waitlist form,
#   and the sample church at https://faithkit.org/demo (its admin included).
#
# Out of scope
#   A church's own self-hosted copy of FaithKit lives on that church's
#   server. Please report anything about a self-hosted site to the church
#   that runs it; if the fault is in FaithKit itself, tell us too.
#
# What to expect
#   Write plainly, tell us what you found and how to see it, and we will
#   answer you and fix it. We do not run a bounty program. We will thank
#   you by name in CREDITS.md if you would like that — or keep you
#   anonymous if you would not.