plumbline security policy

Report a vulnerability in https://plumbline.apps.mrida.ng by email to
mridang.agarwalla@gmail.com. Please include what you found, the address or
request it affects, and the steps to reproduce it. Do not include other
people's data; a description of your own test is enough.

What to expect
- An acknowledgement within 5 days.
- A fix, or an honest answer about why there is none, within 90 days. You will
  be told when it is fixed, and credited if you want to be.
- No legal action against anyone who reports in good faith, follows this
  policy, and stops at proving the problem: do not degrade the service for
  others, and give a reasonable time to fix before you share the details.

In scope
- https://plumbline.apps.mrida.ng and its API, including the fetches it makes
  on a scan's behalf.

Out of scope
- Cloudflare's platform, and the third-party sites that are scanned.
- Denial of service by volume, spam, social engineering, and physical attacks.
- Missing headers or settings with no demonstrable impact.

This policy is also linked from https://plumbline.apps.mrida.ng/.well-known/security.txt