# Domduck security contact.
# Reports are read by a person. There is no bug bounty and no payment.

Contact: mailto:security@domduck.com
Expires: 2027-08-03T00:00:00.000Z
Preferred-Languages: en
Canonical: https://domduck.com/.well-known/security.txt

# Worth knowing before you test:
# - There are no passwords. Authentication is magic link only.
# - /api/lookup, /api/badge and /api/mcp/public are public by design.
#   They are rate limited and read stored data; that is not a finding.
# - Please do not run automated scanners against the sweep endpoints.