# Varro security disclosure policy — RFC 9116
# https://varro-tax.co.uk/.well-known/security.txt

Contact: mailto:security@varro-tax.co.uk
Expires: 2027-04-15T00:00:00Z
Preferred-Languages: en
Canonical: https://varro-tax.co.uk/.well-known/security.txt
Policy: https://varro-tax.co.uk/legal/security-policy

# Please include:
#   - the affected URL or component
#   - steps to reproduce
#   - impact assessment
#   - any proof-of-concept
#
# We will acknowledge receipt within 2 working days and
# aim to provide a remediation timeline within 10 working
# days. Coordinated disclosure is appreciated — please
# give us 90 days before public disclosure where possible.