# ==============================================================================
# security.txt — Samir Shaikh Portfolio & AI Systems
# Standard: RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)
# Canonical URL: https://samir-portfolio-dev.vercel.app/.well-known/security.txt
# Mirror URL: https://samir-portfolio-dev.vercel.app/security.txt
# ==============================================================================

# Primary Security Contacts
Contact: mailto:shaikh.samir.work@gmail.com
Contact: https://samir-portfolio-dev.vercel.app/contact

# Expiration Date (RFC 3339 format)
Expires: 2027-12-31T23:59:59.000Z

# Preferred Languages for Communication
Preferred-Languages: en, hi, gu

# Canonical URI
Canonical: https://samir-portfolio-dev.vercel.app/.well-known/security.txt

# Security & Vulnerability Disclosure Policy
Policy: https://samir-portfolio-dev.vercel.app/privacy-policy

# Researcher Acknowledgments & Contributions
Acknowledgments: https://github.com/samirshaikh-dev

# Career & Engineering Opportunities
Hiring: https://samir-portfolio-dev.vercel.app/resume

# ==============================================================================
# VULNERABILITY DISCLOSURE & SAFE HARBOR GUIDELINES
# ==============================================================================
# 1. Reporting Guidelines:
#    If you discover a security vulnerability, please send an email to
#    shaikh.samir.work@gmail.com or submit details via https://samir-portfolio-dev.vercel.app/contact.
#    Please include:
#    - Clear description and severity assessment
#    - Step-by-step reproduction steps or proof-of-concept (PoC)
#    - Affected endpoint(s), parameter(s), or environment details
#
# 2. Response Timeline:
#    - Initial acknowledgment: Within 24-48 hours
#    - Vulnerability assessment & triage: Within 3-5 business days
#    - Remediation update & fix deployment: Timely based on severity
#
# 3. Safe Harbor Commitment:
#    We support ethical and responsible security research. If you make a good-faith
#    effort to comply with this policy during your security research, we will not
#    pursue legal action against you or initiate any law enforcement complaint.
#
# 4. Out-of-Scope Activities:
#    - Distributed Denial of Service (DDoS/DoS) attacks
#    - Spam, social engineering, or phishing of site visitors or administrators
#    - Automated scanner dumps without verified proof-of-concept demonstration
#    - Physical security attacks or third-party infrastructure disruption
# ==============================================================================