# RFC 9116. CRIT5-4 (critic runs 5–9): a security reviewer's first two URLs are
# /.well-known/security.txt and /security.txt — both were 404 while hello@ was the
# only published contact. A vulnerability report with nowhere to go becomes a disclosure.
Contact: mailto:security@rekvira.com
Contact: mailto:hello@rekvira.com
Expires: 2027-09-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://rekvira.com/.well-known/security.txt
Policy: https://rekvira.com/privacy
# Procurement egress allowlisting: MCP is HTTPS on mcp.rekvira.com/mcp only.
# Rekvira does not publish a static egress IP list (Cloudflare anycast).
MCP-Endpoint: https://mcp.rekvira.com/mcp