# Campus Coffee — security contact
# If you found something, please tell us before you tell anyone else.

Contact: mailto:support@campuscoffee.online
Expires: 2027-07-30T14:52:57Z
Preferred-Languages: en, hi
Canonical: https://campuscoffee.online/.well-known/security.txt
Policy: https://campuscoffee.online/legal/privacy#security

# Scope
#   https://campuscoffee.online/ and its API.
#
# In scope, and genuinely wanted:
#   Anything that lets one student read, write or delete another student's data.
#   Anything that reveals a blind-coffee partner before the reveal.
#   Anything that reaches a photo, a selfie or a location outside a signed link.
#   Anything that gets an unverified account into a matching pool.
#
# Out of bounds, and the reason this file exists:
#   Do not test against a real student's account, chat, photos or location.
#   Do not run automated scanners, load tests or brute force against the app.
#   Do not exfiltrate data. One record is enough to prove a finding — stop there.
#   Do not use a finding to contact, unmask or harass anyone.
#
# What you get: a reply, a fix, and credit if you want it. This is a free
# student project with no budget, so there is no bounty — that is stated up
# front rather than discovered afterwards. A report made in good faith, within
# the bounds above, will not be pursued.
#
# Policies last updated: 29 July 2026