# BlockArrow Capital — Security disclosure policy
# RFC 9116 (https://www.rfc-editor.org/rfc/rfc9116)

Contact: mailto:tommysutker@blockarrow.io
Contact: https://blockarrow.xyz/contact
Expires: 2027-05-12T00:00:00.000Z
Preferred-Languages: en
Canonical: https://blockarrow.xyz/.well-known/security.txt
Policy: https://blockarrow.xyz/legal/disclosures

# Scope
#   In scope:  blockarrow.xyz, *.blockarrow.xyz
#   Out of scope: third-party administrators, custodians, and analytics
#                 providers — please report directly to the vendor.
#
# We acknowledge good-faith reports within two business days and aim to
# remediate confirmed vulnerabilities on a severity-weighted timeline.
# We do not currently operate a paid bug bounty.