<?xml version="1.0" encoding="UTF-8"?>
<!--
  Four URLs now, where there was one.

  The platform itself is a hash-routed SPA: every screen lives behind #/ , which
  a crawler never requests as a separate URL and a sitemap cannot address. That
  has not changed, and #/login still does not belong here.

  What changed is that there are now genuinely server-addressable pages. They
  are static HTML in public/, served straight off disk, and their content is in
  the document rather than assembled by JavaScript after load — which is the
  only reason listing them is worth anything. Listing a URL that returns the SPA
  shell tells a search engine the same nothing four times.

  The previous version of this file said these would be added "when the
  marketing site grows real server-addressable pages, not before". This is that.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://exceptionsecurity.com/</loc>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/how-it-works/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/vulnerability-disclosure/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/private-bug-bounty/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/bug-bounty-vs-penetration-testing/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/security/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/about/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <!--
    The two pages a stranger is actually sent to. /disclosure-programme/ shipped
    on 15 September and was never listed here, which meant the one page written
    to be found by someone searching for how to receive vulnerability reports
    was the one page a crawler was never told about.
  -->
  <url>
    <loc>https://exceptionsecurity.com/disclosure-programme/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/snapshot/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/impact-scoring/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/sample-report/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/partners/</loc>
    <lastmod>2026-10-12</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/pricing/</loc>
    <lastmod>2026-10-13</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/who-tests/</loc>
    <lastmod>2026-10-13</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/privacy/</loc>
    <changefreq>monthly</changefreq>
    <priority>0.5</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/research/payment-aggregators-security-txt/</loc>
    <lastmod>2026-09-30</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://exceptionsecurity.com/research/wallet-issuers-security-txt/</loc>
    <lastmod>2026-10-05</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
</urlset>
