# Wounded Warriors — Security Disclosure Policy
# RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)
#
# This file is the canonical location for security-vulnerability reporting
# for warriorsfund.org and the public Wounded Warriors Veterans Resource API
# at warriors-fund-api.emperormew.workers.dev.
#
# We are a 501(c)(3) public charity (EIN 86-1336741, The Woodlands TX).
# Veterans rely on this service. We treat security reports with priority.

Contact: mailto:security@warriorsfund.org
Contact: mailto:info@warriorsfund.org
Expires: 2027-04-25T00:00:00.000Z
Preferred-Languages: en
Canonical: https://warriorsfund.org/.well-known/security.txt
Policy: https://warriorsfund.org/privacy
Acknowledgments: https://warriorsfund.org/verify

# Reporting guidance:
#   - Please disclose responsibly: give us a reasonable window (typically
#     30-90 days) to remediate before public disclosure.
#   - Crisis-resource integrity issues (anything affecting the 988-routing
#     CrisisBanner / CrisisInterstitial / CrisisFAB) get priority: we will
#     acknowledge within 24 hours and patch within 72 hours.
#   - Data exposure issues (PII in any of our 143,700+ resource records,
#     intake form data, donor data) also get priority.
#   - DDoS / brute-force / credential-stuffing reports are appreciated but
#     deprioritized vs. exploitable vulnerabilities.
#
# What we run:
#   - React 19 SPA on Cloudflare Pages
#   - Cloudflare Workers + D1 + KV for the API
#   - Givebutter, The Giving Block, PayPal Giving Fund for donation flows
#     (these have their own security.txt — please file payment-flow issues
#      with the respective vendor as well as with us)
#   - GitHub for source control (responsible-disclosure via @EmperorMew)
#
# Out of scope (not eligible for acknowledgments):
#   - Findings against external-vendor pages we link to (VA.gov, IRS,
#     ProPublica, Candid, Charity Navigator, etc.)
#   - Self-XSS, clickjacking on logout, missing security headers without
#     a demonstrated attack path
#   - Issues requiring physical access or local malware
#
# Hall of fame: https://warriorsfund.org/verify (we list contributors who
# explicitly request public acknowledgment)