# Trivball — security contact
# https://trivball.com/.well-known/security.txt
#
# Trivball is an independent, non-commercial fan project run by one person.
# There is no bug bounty and no payment, but reports are read and acted on.

Contact: mailto:contact@trivball.com
Expires: 2027-09-02T00:00:00.000Z
Preferred-Languages: en
Canonical: https://trivball.com/.well-known/security.txt
Policy: https://trivball.com/terms

# What is in scope
#   trivball.com — the site, its server functions, and party-mode rooms
#     (the /ws/:code WebSocket and /api/room/:code).
#
# What is NOT in scope
#   ESPN, Wikipedia and other upstream data providers. The site reads their
#   public endpoints; it does not control them. Report issues to them directly.
#   Missing or wrong sports data is a content bug, not a security issue — use
#   the in-app "Report this board" button for that.
#
# Please do not run automated scanners, load tests, or room-code enumeration
# against the live site. It runs on a free Cloudflare plan, so a scan is
# indistinguishable from an outage and will just break the game for whoever is
# playing. A written description of the issue is enough; ask first if you need
# to demonstrate it.
#
# There is now an edge rate limit on the party endpoints (/api/room/* and
# /ws/*), so an enumeration attempt will be blocked rather than served. That is
# a cap on abuse, not an invitation to test it — the limit is per IP and
# tripping it degrades party mode for anyone sharing your address. Nothing else
# on the site is rate limited.