# Gibson App — security contact and coordinated vulnerability disclosure.
# Operated by Zoundio AB, Gotgatan 34, 118 32 Stockholm, Sweden.
# Please report security issues to us privately before disclosing publicly.
# Full policy, scope and safe-harbour terms: https://www.gibson.app/security-policy
#
# We do NOT run a bug bounty programme and we do not pay for reports.
# We offer a fast human response, a fix, and public credit if you want it.
# Reports must include reproducible steps and a demonstrated impact —
# automated scanner output without a working proof of concept is out of scope.
#
# Scope: the Gibson App (iOS/Android), gibson.app and the APIs behind them.
# gibson.com, identity.gibson.com and other Gibson Brands services are NOT
# operated by us; report issues with those to Gibson Brands.

Contact: mailto:security@zoundio.com
Contact: https://www.gibson.app/security-policy
Expires: 2027-08-01T00:00:00.000Z
Policy: https://www.gibson.app/security-policy
Preferred-Languages: en, sv
Canonical: https://www.gibson.app/.well-known/security.txt

# Encryption: https://www.gibson.app/pgp-key.txt