# Roamzy security disclosure policy (RFC 9116)
#
# If you've found a security issue in Roamzy — the eSIM service, the
# REST API at /api/v1/*, the MCP server, the anon-session / claim flow,
# the dashboard, or any of our infrastructure — please report it via one
# of the contacts below. We take all reports seriously, especially around
# payment integrity, token security, and the anon-flow claim 2FA model.

Contact: mailto:security@roamzy.io
Contact: https://t.me/roamzy_support_bot
Expires: 2027-05-21T00:00:00.000Z
Preferred-Languages: en, ru
Canonical: https://roamzy.io/.well-known/security.txt
Policy: https://roamzy.io/legal/security
Acknowledgments: https://roamzy.io/legal/security#acknowledgments

# Scope (in priority order):
#   1. Payment integrity — anything that lets balance be credited without
#      USDT settlement, or topup amount mismatching paid amount.
#   2. Token / claim_token leakage paths (URL caching, log leakage, env
#      var exposure).
#   3. Cross-user data access via /api/admin/* (we lock these to admin
#      session cookie + IP check, but novel bypasses are interesting).
#   4. Privilege escalation through anon-session abuse — e.g. flooding
#      anon-session creation to exhaust pool, or claim 2FA bypass.
#   5. XSS / CSRF on dashboard or claim.html.
#
# Out of scope:
#   - Findings requiring physical access or stolen device.
#   - Self-XSS where the user pastes attacker code into devtools.
#   - Issues in third-party services we depend on (NowPayments, Venta,
#     Cloudflare, Fly) — report those upstream first.
#
# We do not have a paid bug bounty program. We do publicly acknowledge
# valid reports at the Acknowledgments URL above.