Skip to content
LogoLogo

Security policy

Arrekta settles real value. If you find a vulnerability, please report it privately so it can be fixed before it is exploited.

Reporting

  • Do not open a public issue for security problems.
  • Email the security contact listed on the project website (to be published before testnet) with:
    • a description;
    • the affected component and version (commit);
    • steps or a proof of concept;
    • your assessment of impact.
  • Until the contact is published, reach the maintainers privately through the repository host's private vulnerability reporting.
  • We acknowledge reports within 3 working days and give a first assessment within 10.

Scope

The node implementations (node-rs/, core/), the consensus specification (core/PROTOCOL.md), and the platform services (arrekta-gateway, arrekta-wallet, arrekta-issuer, arrekta-indexer). See docs/AUDIT_SCOPE.md for the threat model and priority areas, and docs/BUG_BOUNTY.md for rewards.

Out of scope:

  • third-party services and front-ends;
  • denial of service by sheer volume;
  • findings that need a compromised operator machine;
  • the public regtest test keys (they are public by design).

Disclosure

  • We coordinate a fix and a release, then publish an advisory.
  • Critical consensus issues use a private patch to node operators first.
  • Default embargo is 90 days, shorter if the issue is being exploited.
  • Advisories and releases are signed with the project's ML-DSA release keys (see docs/OPERATIONS.md).
  • Reporters are credited unless they ask not to be.

Supported versions

Before mainnet, only the latest commit on the main branch is supported. After mainnet, the latest release and the previous one receive security fixes.