Contact: mailto:security@mysalarypal.com
Contact: https://mysalarypal.com/trust
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://mysalarypal.com/.well-known/security.txt
Policy: https://mysalarypal.com/trust
Acknowledgments: https://mysalarypal.com/trust

# MySalaryPal (MSP) Responsible Disclosure
#
# We welcome security reports from researchers, customers, and corporate
# IT teams evaluating MSP for rollout. Please email security@mysalarypal.com
# with reproduction steps. We aim to acknowledge within 2 business days.
#
# Please do NOT:
#   - Run automated scanners against production without prior approval
#   - Access, modify, or delete data that is not your own
#   - Perform DoS / load testing
#
# In scope:
#   - mysalarypal.com and *.mysalarypal.com
#   - Lovable Cloud backend powering the above
#
# Out of scope:
#   - Rate-limiting on public marketing pages
#   - Third-party services (Cloudflare, Supabase, Paddle, Google) — report to them