# Fletch — security disclosure (RFC 9116)
#
# Fletch is a non-custodial front-end over IMMUTABLE, real-ETH smart contracts on
# Robinhood Chain. The contracts cannot be paused, patched, or upgraded, and at
# launch they are NOT covered by a completed independent audit. If you have found a
# vulnerability, please report it privately using the Contact below BEFORE any public
# disclosure — a coordinated report lets us warn users and pull the affected surface
# from this front-end even though the on-chain code itself cannot be changed.
#
# There is no paid bug bounty at this time. We will not misrepresent that as one.
# See https://fletch.bond/trust for what we can and cannot do about a disclosed bug.
#
# OPERATOR NOTE: Contact is the project's monitored Proton mailbox — the SAME
# address used for the /legal §07 deletion request and any legal/whitehat notice.
# Refresh the Expires date below before it lapses.

Contact: mailto:fletchlaunchpad@proton.me
# Secondary, public channel — for reaching us if the mailbox above bounces. Do
# NOT post vulnerability details here; use it only to ask for a private channel.
Contact: https://x.com/fletchbondrh
Expires: 2027-01-15T00:00:00.000Z
Canonical: https://fletch.bond/.well-known/security.txt
Policy: https://fletch.bond/trust
Preferred-Languages: en