# Luxe Copilot security disclosure policy (RFC 9116)
# https://luxecopilot.com/.well-known/security.txt

Contact: mailto:security@luxecopilot.com
Contact: mailto:hello@luxecopilot.com
Expires: 2027-06-09T00:00:00Z
Preferred-Languages: en, zh-CN
Canonical: https://luxecopilot.com/.well-known/security.txt
Policy: https://luxecopilot.com/privacy
Acknowledgments: https://luxecopilot.com/about

# Scope
# In scope: luxecopilot.com (Next.js on Vercel), api.luxecopilot.com (FastAPI), browser extension (Plasmo).
# Out of scope: third-party affiliate redirects (Skimlinks/Awin/Rakuten/PartnerStack), upstream retailer sites.
#
# Please disclose privately first. We will respond within 5 business days.
# Affiliate fraud / cookie stuffing reports also welcome at the same address.