Security
Vulnerability disclosure policy
We build security tooling, so we take reports about our own systems seriously. If you think you have found a vulnerability, please tell us.
How to report
Email [email protected]. Please include:
- what is affected (URL, repository or component) and what an attacker could do;
- steps to reproduce, or a proof of concept;
- how you would like to be credited, if at all.
Please don’t put details of an unfixed issue in a public GitHub issue.
Scope
- In scope: magichain.io and www.magichain.io, and public repositories in the magiChainSecurity GitHub organization.
- Out of scope: denial-of-service and load testing, social engineering or phishing of our team, physical attacks, and the services we run on (Cloudflare, GitHub, our email provider), which you should report to them directly.
What to expect
- We acknowledge your report within 3 business days.
- We send an assessment and a planned fix date within 10 business days.
- We keep you updated until it is fixed, and credit you if you want to be credited.
- We ask that you give us 90 days from your report before public disclosure, or less if we have shipped a fix.
We don’t run a paid bug bounty yet.
Safe harbour
If you act in good faith and follow this policy, we will not pursue or support legal action against you for your research. Good faith means you:
- only test against systems in scope, and stop as soon as you have shown the issue;
- don’t access, change or keep other people’s data beyond what is needed to show the issue;
- don’t degrade our services or anyone else’s;
- give us reasonable time to fix the issue before telling anyone else.
If in doubt about whether something is allowed, ask us first at [email protected].