# Tim Hortons vulnerability disclosure (RFC 9116)
# https://www.rfc-editor.org/rfc/rfc9116.html
#
# If you believe you have found a security vulnerability, please report it
# through the channels below so we can route it to the right team quickly.
#
# Renewal: DEX updates this file; Product Security owns the HackerOne channel.
# Remind 30 days before Expires.
# After Okta + Hacker Management: prepend Contact: https://hackerone.com/<program-slug>
# Do not add mailto: unless Product Security confirms a monitored inbox.

Canonical: https://www.timhortons.ca/.well-known/security.txt
Canonical: https://www.timhortons.com/.well-known/security.txt
Contact: https://www.timhortons.ca/report-security-issue
Contact: https://www.timhortons.com/report-security-issue
Expires: 2027-07-19T00:00:00.000Z
Policy: https://www.timhortons.ca/report-security-issue
Policy: https://www.timhortons.com/report-security-issue
Preferred-Languages: en, fr