PAVO Fitness — Security PGP Public Key
======================================

STATUS: NOT YET PUBLISHED

The PGP key for develop@pavofitness.com has not been generated yet. This file
is a placeholder so that the URL referenced from security.txt and from the
disclosure policy resolves instead of returning 404.

Until the key is published:

  - Send your report to develop@pavofitness.com unencrypted, but keep exploit
    detail, credentials and any captured data OUT of the first message.
  - Tell us that you have sensitive material to share. We will arrange an
    encrypted channel before you send it.

When the key is generated, this file will be replaced with the ASCII-armored
public key block, and the fingerprint will be published on
https://security.pavofitness.com/ and in security.txt.

----------------------------------------------------------------------
TO PUBLISH THE KEY (internal checklist, remove this section on publish)
----------------------------------------------------------------------

  1. gpg --full-generate-key
       Type:     RSA and RSA (or ECC / Curve25519)
       Length:   4096 (if RSA)
       Expiry:   2y
       Real name: PAVO Fitness Security
       Email:     develop@pavofitness.com

  2. gpg --armor --export develop@pavofitness.com > pgp-key.txt

  3. gpg --fingerprint develop@pavofitness.com
       Copy the fingerprint into:
         - site/index.html          (contact card, "Fingerprint: pending publication")
         - site/zh/index.html       (contact card, "指纹：待发布")
         - policy/vulnerability-disclosure.md
         - policy/vulnerability-disclosure.zh.md

  4. Store the private key and its revocation certificate in the team password
     manager. Do NOT commit either to this repository.