Disclosure policy

Send vulnerability reports to [email protected]. Do not include a recovery phrase, a private key, or a live exploit against someone else's funds. We would rather have a partial report today than a complete one that puts a user at risk.

What we want to hear about

This policy covers the Zunia clients, the websites we operate at zunialab.com and docs.zunialab.com, and the repositories under the Zunia-Lab organisation that ship those products. A bug that lets a page steal a key, skip an approval, weaken the keystore, impersonate a pairing peer, or inject content into the site is in scope.

Also in scope: a supply-chain issue in a dependency we ship, a release artifact that does not match the tag, and a flaw in the way the extension talks to a page. If you are unsure, send it. Sorting is our job.

What is out of scope

• A lost phrase, a mistaken address, or a transaction you approved. We cannot reverse those, and the report will not change that.
• Phishing sites, fake tokens, or social accounts that are not ours. Tell us so we can warn people, but they are not a vulnerability in the client. There is no Zunia token to claim.
• Issues in a chain, a validator, an RPC provider, a hardware wallet, or a store. Report those to their operators.
• Missing headers or best-practice nits that do not show a concrete impact, and reports from automated scanners with no explanation.
• Denial of service against a public endpoint we do not operate.

How to send a report

Email [email protected]. Put "vulnerability" in the subject. Include:

• The component, the version or commit, and the platform.
• What an attacker can do, and what they already need to have.
• The steps to reproduce, or a proof of concept that does not touch anyone else's funds.
• Whether you have told anyone else.
• How you want to be credited, if you want credit at all.

You can encrypt the mail if you have a key for that address published in security.txt or in the GitHub SECURITY.md. If you do not, ordinary mail is still better than sitting on the bug. Do not open a public GitHub issue for an unfixed vulnerability.

What not to send

Do not send a recovery phrase to prove you have one. Do not access an account that is not yours. Do not run a proof of concept against the production website in a way that destroys data or takes the site down. Stop when you have shown impact.

What we do next

We acknowledge the report. We aim to do that within three business days, and to give you a first assessment within ten. Those are targets, not a contractual service level. If your report is clear, the assessment is faster. If it is a scanner dump, it is slower.

If we confirm the issue, we work on a fix. We ask you to wait 90 days after the report, or until a fix is shipped, whichever is sooner, before you publish the details. If a fix needs longer because a store review or a coordinated client release is in the way, we will say so and agree a date with you. We will not ask for silence past the point where users are safer knowing.

We credit researchers who want credit, in the release notes or on this site, using the name you give us. We do not credit a report we cannot reproduce.

No bounty yet

A paid bounty program is planned. It is not open. Sending a report under this policy does not create a right to payment. If we later publish a bounty, it will say which reports qualify and how they are paid. Until that page exists, assume there is no reward other than credit.

Safe harbour

If you follow this policy, act in good faith, avoid privacy violations, avoid destruction of data, and stop when the issue is shown, we will not bring a legal claim against you for that research. This is our statement. It does not bind a chain, a store, a hosting provider, or any other person. It does not cover research that targets other users' funds or that breaks the law for a reason this policy does not ask for.

Good faith includes giving us a chance to fix the issue before you publish, within the window above. Publishing a weaponised exploit on day one, against a bug you have not reported, is outside this harbour.

Official channels

Reports and follow-ups stay on [email protected]. General product questions go to [email protected]. We do not take vulnerability reports in social-media direct messages. The X account @ZuniaLab can point you here. It is not the inbox.