# Touchline Analysis — security contact (RFC 9116)
#
# OPERATOR NOTE: Cloudflare Pages skips dot-directories when it builds a
# deployment, with `.well-known` as the documented exception — so this file
# does publish. Verify after the next deploy with:
#     curl -sI https://touchlineanalysis.com/.well-known/security.txt
# If it 404s, the fallback is a /security.txt at the root plus a redirect;
# do not silently leave a dead advertised contact.
#
# Expires is MANDATORY under RFC 9116 and a stale value makes the file
# non-conforming. Set it about a year out and put a reminder in the calendar
# to move it — this is the one line here that rots on its own.
#
# One inbox: hello@ is the only address that exists, so security@ is not
# advertised here. An address in this file is fetched by automated scanners
# and quoted in disclosure emails — advertising one that bounces loses the
# report. The security policy now lives at /privacy#security (the standalone
# /security page was folded in on 2026-08-19); /security still 301s there,
# but this file names the real destination rather than leaning on it.

Contact: mailto:hello@touchlineanalysis.com
Contact: https://touchlineanalysis.com/privacy#security
Expires: 2027-09-30T00:00:00.000Z
Preferred-Languages: en
Canonical: https://touchlineanalysis.com/.well-known/security.txt
Policy: https://touchlineanalysis.com/privacy#security