# Security Policy

Rob Hamilton (Rob1Ham), 12 Aug: security.md is the most important file in a public repo if it handles money or bitcoin. That is the remit of this file, not a lecture.

Dade is the face on the security page. Dade is appearance-only. Reports still go to the email below until a real security seat exists.

## Reporting a Vulnerability

Email popwilleatitself@proton.me. Do not open a public issue for a vulnerability.

We aim to acknowledge reports within two business days. There is no bounty until a real security seat exists.

## In scope

This repository, the studio site, and later site or tools we ship.

## Out of scope

Third-party wallets, hardware, exchanges, and vendors we review or affiliate. A hack at a recommended company is not our vulnerability. Coinkite is the reminder: their stack is theirs.

## Keys and funds

We never ask for, store, or accept seed phrases, private keys, or user funds. If a page or form ever would, that is a bug. Report it.

Do not commit keys, tokens, or `.env` files to this repository.