# DimensionKit security contact.
#
# Reports are read and acknowledged. Please include enough detail to
# reproduce the issue; a request and response log is ideal.
#
# There is no bug bounty and no monetary reward. Reports are still
# welcome, and we are glad to credit you if you would like that.
#
# Before reporting the OAuth registration endpoint: /oauth/register
# implements RFC 7591 dynamic client registration and is open without
# authentication deliberately. It is what lets an MCP client connect
# from a pasted URL, and it is required by the MCP authorization
# specification. Registering a client grants no access to anything —
# PKCE (S256) is mandatory, redirect URIs are validated and fixed per
# client at registration, and nothing reaches an account until a
# signed-in user approves it on the consent screen. We are aware of it
# and it is not a finding.

Contact: mailto:security@dimensionkit.com
Expires: 2027-11-07T00:00:00Z
Preferred-Languages: en
Canonical: https://dimensionkit.com/.well-known/security.txt
Canonical: https://app.dimensionkit.com/.well-known/security.txt