# Typelesson — how to report a security issue
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:contact@typelesson.com
Expires: 2027-09-11T00:00:00.000Z
Preferred-Languages: en
Canonical: https://typelesson.com/.well-known/security.txt

# Notes for researchers:
# - Leaderboard scores are submitted by the browser and are not
#   cryptographically verified. Forged scores are a known limitation,
#   documented in the README, not a vulnerability report we need.
# - The Supabase key shipped in the client bundle is the publishable key.
#   It is designed to be public; every table behind it is protected by
#   row-level security. Please verify RLS bypass before reporting key exposure.