# Moveable — security contact (RFC 9116)
#
# Moveable is a tool that tells people moving to Barcelona whether a rental
# deal is normal and legal. It holds email addresses and quiz answers. If
# you have found something that puts that data, or our users, at risk, we
# want to hear about it and we will not come after you for telling us.
#
# NOTE: Expires is mandatory under RFC 9116 and this file is static, so it
# has to be refreshed by hand. Renewing it is on the annual review in
# docs/security-launch-checklist.md — an expired security.txt is treated as
# invalid by scanners and by some researchers.

Contact: mailto:hello@moveable.es
Expires: 2027-08-08T00:00:00.000Z
Preferred-Languages: en, es, ca
Canonical: https://moveable.es/.well-known/security.txt

# What we would especially like to know about:
#   - anything that exposes another user's email address or quiz answers
#   - any way to make Moveable send email to an address you do not control
#   - any way to read or write the database with the publishable key
#
# Please do not run load tests, denial-of-service tests, or automated
# scanners against the production site. A description and a single
# proof-of-concept request is enough; we will reproduce it ourselves.