# Gen318 vulnerability disclosure — RFC 9116
#
# Gen318 is the operational intelligence layer beneath solar mini-grids and C&I
# solar in Nigeria. A defect here can affect electricity supply to a community,
# so we would much rather hear from you than not.

Contact: mailto:security@gen318.com
Contact: https://gen318.com/security

Expires: 2027-08-17T00:00:00.000Z

Preferred-Languages: en

Canonical: https://gen318.com/.well-known/security.txt

Policy: https://gen318.com/security

# What we ask
#
# Report privately first and give us a reasonable chance to fix it. Do not run
# denial-of-service tests, do not touch a live mini-grid's control or dispatch
# surface, and do not access, alter or retain any customer's operational or
# personal data. If you reach data that is not yours, stop and tell us what you
# saw — that is a report, not a finding to develop further.
#
# What we commit to
#
# We acknowledge inside 3 working days and tell you our assessment inside 10.
# We will not pursue legal action over good-faith research that follows the
# above. We credit reporters who want it.
#
# Note on scope: app.gen318.com is the production operator console and carries
# real customer data. If you need somewhere to test destructively, ask us and we
# will discuss standing up an environment rather than have you do it there.