Contact: mailto:security@real-signal.ai
Contact: https://real-signal.ai/takedown
Expires: 2027-06-26T00:00:00Z
Preferred-Languages: en
Canonical: https://real-signal.ai/.well-known/security.txt
Policy: https://real-signal.ai/security
Acknowledgments: https://real-signal.ai/security#acknowledgments

# Real Signal accepts coordinated disclosure of security or privacy issues
# affecting any of:
#   - real-signal.ai (substrate, MCP server, research surfaces)
#   - signalai.io (institutional outbound mail)
#   - npm packages @real-signal/*
#   - the public MCP server at /api/mcp
#
# Please allow up to 30 days for triage and remediation before public
# disclosure. We do not run a paid bug bounty programme. We acknowledge
# valid reports at /security#acknowledgments with reporter consent.