# Security Policy

Expedition Insure takes the security of our customers' data seriously. We
appreciate the work of security researchers and welcome reports of
vulnerabilities in our service.

## Reporting a Vulnerability

**Do not file public GitHub issues for security vulnerabilities.**

Email **security@expedition.insure** with:

- A description of the issue and its potential impact
- Steps to reproduce (proof-of-concept code, screenshots, or video where helpful)
- The affected URL, endpoint, or component
- Your name and contact info (optional — we credit researchers who consent)

We will acknowledge receipt within **2 business days** and aim to provide a
substantive response within **5 business days**.

## Safe Harbor

We will not pursue legal action against researchers who:

1. Make a good-faith effort to avoid privacy violations, data destruction, and
   service interruption
2. Only interact with accounts they own or have explicit permission to test
3. Give us reasonable time to remediate before public disclosure (we target
   90 days)
4. Do not exploit a vulnerability beyond the minimum needed to confirm it
5. Comply with all applicable laws

Activities **out of scope** for safe harbor: denial-of-service, social
engineering of staff or customers, physical attacks, spam, or any action that
degrades service for other users.

## Scope

In scope:

- `expedition.insure` and all subdomains
- Production Convex deployment (`helpful-anteater-383.convex.cloud`)
- Mobile-web behavior of the above

Out of scope:

- Third-party services we depend on (Cloudflare, Convex, Stripe, Resend, Google) —
  please report to those vendors directly
- Findings already documented in our public bug-fix queue
- Best-practice recommendations without a demonstrable security impact (e.g.,
  missing security headers without an exploit chain)

## Public Disclosure

We coordinate disclosure with reporters. After a fix ships and any required
customer notification has occurred, we are happy to credit researchers in our
release notes.

## Compliance

Expedition Insure is pursuing SOC 2 Type II attestation. A current copy of our
report is available under NDA — contact `security@expedition.insure`.

For routine vulnerability disclosure mechanics, see
[`/.well-known/security.txt`](https://expedition.insure/.well-known/security.txt)
(RFC 9116).