The security contact file (security.txt)
========================================

Tillyard. Version 1.0.
In effect from October 20, 2026.
Fingerprint of this text (SHA-256): 741ad709c8b8faec47b2dd56a73327250e05168201319f2687c35fd806750d6e
This version: https://tillyard.org/policies/security-txt/v/1.0

- Tillyard publishes a short text file at
  https://tillyard.org/.well-known/security.txt. It tells security researchers,
  and the tools they use, where to send a report.
- The file gives one contact, security@tillyard.org, and links to the Security
  and Vulnerability Disclosure Policy, which has the rules for testing.
- The file is built by the site each time it is asked for, so its expiry date
  always stays about six months ahead.
- The file is a signpost. It gives no permission by itself. The policy does
  that, and the policy governs.
- If the security address has not been set, the site answers "not found" and
  serves no file at all, so a stale or empty contact is never published.

If this summary and the full text below ever differ, the full text governs.

1. What this file is for
========================

A security contact file is a convention, set out in an internet standard
called RFC 9116, that lets a website say in a fixed place and a fixed format
where security problems should be reported. People who find a weakness look
there first. So do some automated tools.

The file answers one question: who do I tell? Everything else, including what
testing is allowed and what we commit to in return, is in the Security and
Vulnerability Disclosure Policy. Where this page and that policy cover the
same point, the policy governs.

2. The exact contents
=====================

This is the file, line for line. Square brackets mark values that are filled
in from the site's settings.

# [BRAND]: security contact
# If you have found a security problem on this site, thank you.
# Please read the policy linked below before you test anything.
# It says what is allowed and what is not. There is no bounty.
Contact: mailto:[SECURITY EMAIL]
Expires: [SECURITY TXT EXPIRES]
Preferred-Languages: en
Canonical: https://[DOMAIN]/.well-known/security.txt
Policy: https://[DOMAIN]/security

The file ends with a single line break after the last line. It contains
nothing else: no names of people, no telephone number and no postal address.

2.1 An example as served
------------------------

On 10 October 2026, with a 180-day window, the dated line would read:

Expires: 2027-04-08T00:00:00Z

3. What each line means
=======================

What each line means. Columns: line, meaning, where the value comes from.
Line | Meaning | Where the value comes from
-------------------------------------------
Lines beginning # | Comments for a human reader. Tools ignore them | The trade name comes from the site's brand settings. The rest is fixed wording
Contact | Where to send a report. The standard requires at least one | security@tillyard.org, from the site's legal settings
Expires | The moment after which a reader should treat the file as out of date. The standard requires exactly one | Worked out when the file is asked for: the current date plus 180 days, at 00:00 UTC
Preferred-Languages | The language we would like reports in | Fixed: English
Canonical | The one address at which this file is meant to be found, so that a copy found elsewhere can be recognized as a copy | The site's own address
Policy | The page that says what testing is allowed | The address of the Security and Vulnerability Disclosure Policy

4. Lines the standard offers that we do not use
===============================================

- Encryption. We do not publish an encryption key at present. The policy
  (section 7.4) says how to arrange a safer way to send sensitive details.
- Acknowledgments. People who asked to be thanked are listed in section 15 of
  the policy, which the Policy line already leads to. A separate line can be
  added if that list is ever given a page of its own.
- Hiring. Not used. The file is not a place for vacancies, and the company lists
  none there.

The file is not digitally signed. The standard recommends a signature and does
not require one. Without one, a reader's assurance that the file is ours is
that it was fetched over HTTPS from the address in the Canonical line.

5. How the file is served
=========================

- Address. https://tillyard.org/.well-known/security.txt. A request for
  https://tillyard.org/security.txt is redirected there.
- Format. A text file, encoded as UTF-8, over HTTPS only.
- Built on request. The site writes the file each time it is asked for. No copy
  is kept as a static file, because a stored copy's expiry date would go stale.
- Caching. A browser or a network may keep a copy for up to a day.
- If the contact is missing. If no security address is set in the site's
  settings, the address answers "not found". The site's own launch checks treat
  that as something to put right before opening.
- No cookies, no tracking. Fetching the file sets nothing in your browser and
  needs no sign-in.

6. Keeping it current
=====================

- The expiry date moves forward by itself. Nobody has to remember to edit it.
- The contact address is a mailbox that a person reads. If the address ever
  changes, it changes in one setting, and the file, the policy and the contact
  pages all follow.
- An automated test checks that the two required lines are present, that the
  expiry date is in the future and less than a year ahead, and that the file is
  withheld when the contact is blank.

7. If the site is not answering
===============================

The file is written by the site's software. If the site has paused because a
daily allowance has run out, or is otherwise not answering, the file may not
answer either. The security address still works, because it is an ordinary
mailbox that does not depend on the site, and it is also printed on the static
page of legal contacts that stays up when the site is paused.

8. Changes to this document
===========================

The version number and effective date are at the top, and earlier versions
stay available. A change to the wording of the file is made here first.

9. Contact
==========

- A security problem: security@tillyard.org
- Anything else: support@tillyard.org
- Post: Tillyard, 10602 York Rd SW, Etna, Ohio 43062