Contact: mailto:security@artifactly.dev
Contact: mailto:report@artifactly.dev
Preferred-Languages: en
Canonical: https://artifactly.dev/.well-known/security.txt

# security@ - flaws in Artifactly itself, its API, or its handling of
#             retained artifacts.
# report@   - a malicious package that is missing from the corpus, or one
#             we have filed wrongly.

# Artifactly retains real malicious package archives. They are served only
# to credentials holding blob:read and are never executed or extracted
# server-side. See https://artifactly.dev/ for what is public.