# Security Policy for Project Pak-LLM & Sovereign Coder
# Compliant with RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116

# Primary contact is a monitored mailbox. The pak-llm.com domain does not
# currently publish MX records, so security@pak-llm.com cannot receive mail;
# listing it as a contact would silently drop reports.
Contact: mailto:info@sbf-consultancy.net

Preferred-Languages: en, ur

Canonical: https://pak-llm.com/.well-known/security.txt
Policy: https://pak-llm.com/security
Policy: https://pak-llm.com/security/posture
Encryption: https://pak-llm.com/pgp-key.asc
Acknowledgments: https://pak-llm.com/security/acknowledgments
Hiring: https://pak-llm.com/commitments/career-growth

Scope: https://pak-llm.com
Scope: https://www.pak-llm.com
Scope: https://coder.pak-llm.com
Scope: https://www.coder.pak-llm.com

# Response targets (best effort, not a contractual SLA):
# - Initial acknowledgment: within 24-48 hours.
# - Critical severity remediation target: 7-14 days.
# - High/Medium severity remediation target: 30 days.

# Safe Harbor Policy:
# SBF Consultancy (Pvt.) Ltd. and Pak-LLM will not pursue legal action against security researchers
# who discover and report vulnerabilities in good faith and in compliance with this policy.
# Please give us a reasonable remediation window before public disclosure.

Expires: 2027-12-31T23:59:59.000Z