Contact#
Email dev.durgeshkhade@gmail.com with "SECURITY" in the subject line.
Include the affected component and, if you know them, the revision or manifest number; steps or a proof of concept and the impact you expect; and whether and when you plan to publish.
Scope#
In scope: the protocol as specified on this site, meaning consensus, execution and the EVM, authorization and recovery, shielded transfers, networking and RPC, as well as the command-line client, the SDK and this website.
Out of scope: attacks that need more than one third of voting power; social engineering; denial of service against infrastructure we do not operate; and automated scanner output without a demonstrated impact.
How reports are handled#
We acknowledge the report, confirm the issue, fix it, and credit you if you wish. Details of a finding are published on Assurance only after its fix ships. There is no public network and no bug bounty yet; a bounty is one of the mainnet release gates.
A machine-readable contact is published at /.well-known/security.txt.