# Valtik Studios. Security disclosure policy. RFC 9116 compliant.

Contact: mailto:security@valtikstudios.com
Contact: https://valtikstudios.com/contact
Expires: 2027-04-17T23:59:59.000Z
Preferred-Languages: en
Canonical: https://valtikstudios.com/.well-known/security.txt
Policy: https://valtikstudios.com/security

# Valtik Studios runs penetration testing and vulnerability research as a
# professional service. We treat every reported vulnerability with the
# same seriousness we expect from our own clients.
#
# Response targets:
#   - Initial acknowledgment: 48 hours
#   - Triage + severity classification: 5 business days
#   - Fix or mitigation: 30 days for critical, 90 for high, 180 for medium
#
# Safe harbor: good-faith security research on valtikstudios.com that
# avoids data exfiltration, service disruption, and third-party impact
# will not trigger legal action from us.
#
# Not in scope: social engineering of Valtik staff, physical attacks,
# attacks against third-party services we consume (Vercel, Cloudflare),
# denial of service testing.