https://entenc.com/assets/Security-BWAsBOTD.js

1import{j as e}from"./react-DfPlzfW8.js";import{L as s}from"./LegalLayout-Bqv1rkzK.js";import{c as n}from"./index-wN3cS0bk.js";import"./Footer-DB-Am3x0.js";import"./Logo-BIFm_bgv.js";import"./i18n-CaZbNrtY.js";import"./motion-B3-iQnrd.js";import"./supabase-Dfky9hfI.js";/**
2 * @license lucide-react v0.546.0 - ISC
3 *
4 * This source code is licensed under the ISC license.
5 * See the LICENSE file in the root directory of this source tree.
6 */const t=[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]],o=n("shield-alert",t),i="[email protected]";function x(){return e.jsxs(s,{icon:o,title:"Security",lastUpdated:"2026-08-30",children:[e.jsx("h2",{children:"Reporting a vulnerability"}),e.jsxs("p",{children:["If you have found a security issue in the Entenc website, API or browser extension, please email ",e.jsx("a",{href:`mailto:${i}`,children:i}),". Describe what you found and how to reproduce it. You do not need to have a working exploit — a clear description of the weakness is enough."]}),e.jsx("p",{children:"Please report privately and give us a chance to fix the issue before disclosing it publicly. We will not pursue legal action against anyone who reports a genuine issue in good faith and follows this page."}),e.jsx("h2",{children:"What we commit to"}),e.jsxs("ul",{children:[e.jsx("li",{children:"We acknowledge reports within 5 working days."}),e.jsx("li",{children:"We tell you our assessment, and our intended fix, within 15 working days."}

6),e.jsx("li",{children:"We let you know when the fix ships, and we credit you if you would like that."})]}),e.jsx("p",{children:"Entenc is a one-person project, so we do not run a paid bug bounty. What we can offer is a fast, honest response and public credit."}),e.jsx("h2",{children:"In scope"}),e.jsxs("ul",{children:[e.jsx("li",{children:"entenc.com and its subdomains"}),e.jsx("li",{children:"api.entenc.com"}),e.jsx("li",{children:"The Entenc browser extension"})]}),e.jsx("h2",{children:"Out of scope"}),e.jsxs("ul",{children:[e.jsx("li",{children:"Findings that require physical access to a user's unlocked device."}),e.jsx("li",{children:"Denial of service, volumetric or brute-force testing — please do not run these against production."}),e.jsx("li",{children:"Reports generated by an automated scanner with no demonstrated impact."}),e.jsx("li",{children:"Issues in third-party services we build on (Cloudflare, Supabase, Stripe, Google). Report those to the vendor."}),e.jsx("li",{children:"Missing hardening headers or best-practice warnings with no exploitable consequence."})]}),e.jsx("h2",{children:"Please do not"}),e.jsxs("ul",{children:[e.jsx("li",{children:"Access, modify or delete data belonging to anyone but yourself. If you access someone else's data accidentally, stop and tell us."}),e.jsx("li",{children:"Degrade the service for other users while testing."})]}),e.jsx("h2",{children:"Machine-readable"}),e.jsxs("p",{children:["This policy is also published at"," ",e.jsx("a",{href:"/.well-known/security.txt",children:"/.well-known/security.txt"})," in the format described by RFC 9116."]})]})}export{x as default};