From c41f50363581ad8efd5a177d19f5c8f5abc96f4b Mon Sep 17 00:00:00 2001 From: Sawyer <18228063+2dvorak@users.noreply.github.com> Date: Tue, 4 Aug 2026 17:16:23 +0900 Subject: [PATCH] Simplify SECURITY.md Reduce SECURITY.md to the essentials and let the HackenProof program page carry the details, following go-ethereum's approach: - Supported versions: report against the dev branch - Do not disclose publicly, before or after reporting - Link to the bug bounty program The scope and out-of-scope lists, reward criteria, and program rules are maintained on the program page, so keeping copies here only let them drift. The Kaia Web section is also removed: that program has ended. Co-Authored-By: Claude Opus 5 (1M context) --- SECURITY.md | 128 ++++++---------------------------------------------- 1 file changed, 14 insertions(+), 114 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index eef634a04..fe3a733ea 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,123 +1,23 @@ -# Introduction +# Security Policy -Thank you for helping keep the Kaia ecosystem secure. +## Supported Versions -We operate a responsible disclosure and bug bounty program in partnership with [HackenProof](https://hackenproof.com/companies/kaia). This document outlines how to report vulnerabilities, our bounty scope, and program rules. +Please report vulnerabilities against the `dev` branch, which is where all fixes land first. +Releases are cut from `dev`; earlier release branches and tags are not maintained. ---- +## Reporting a Vulnerability -## Reporting a Vulnerability +**Do not report security bugs through public GitHub issues, pull requests, or discussions, +and do not discuss them on Discord, X, or any other public channel** — not before reporting, +and not after a fix ships. Public disclosure without our written permission disqualifies the +report. -Please **do not use GitHub, email, or Discord** to report vulnerabilities. - -Instead, submit all reports via our official bug bounty dashboard: +Report vulnerabilities through our bug bounty program: 👉 [Report a vulnerability on HackenProof](https://hackenproof.com/companies/kaia) -You must report vulnerabilities **within 24 hours of discovery** and exclusively via HackenProof to be eligible for a bounty. - ---- - -## Bug Bounty Program Overview - -We offer bounties for valid, impactful vulnerabilities across the [Kaia Protocol](https://hackenproof.com/programs/kaia-protocol) and [Kaia Web](https://hackenproof.com/programs/kaia-web) ecosystem. - -Reward amounts vary based on: -- Impact -- Severity -- Quality of report and PoC - ---- - -## In-Scope Targets - -### Kaia Protocol (Blockchain Layer) - -Focuses on blockchain protocol vulnerabilities, including but not limited to: -- Stealing or loss of funds -- Unauthorized or manipulated transactions -- Price or fee manipulation -- Balance or tokenomics manipulation -- Privacy violations -- Cryptographic flaws - -### Kaia Web (Web Apps, SDKs, APIs) - -Focuses on web-based vulnerabilities such as: -- Business logic issues -- Payment manipulation -- Remote Code Execution (RCE) -- SQL/XXE Injection -- Access control issues (IDOR, Privilege Escalation) -- Sensitive data leaks -- SSRF, CSRF, XSS -- File inclusion, directory traversal - -See the full list on our [Kaia Web HackenProof Program page](https://hackenproof.com/programs/kaia-web). - ---- - -## Out-of-Scope Vulnerabilities - -Some issues are **not eligible** for bounties, including: - -### Blockchain -- Network-level DoS -- Attacks with unrealistic assumptions - e.g., acquiring privileged accounts - -### Web -- Vulnerabilities in third-party tools -- Best practice concerns without PoC -- Clickjacking, open redirects (without impact) -- TLS config, SPF/DMARC/DNS misconfigs -- Lack of HTTP headers, verbose errors, self-XSS -- DoS/DDoS, social engineering, or phishing -- Issues only affecting outdated browsers -- Vulnerabilities requiring unlikely user actions - -See the full list on our [Kaia Web HackenProof Program page](https://hackenproof.com/programs/kaia-web). - ---- - -## Rules & Guidelines - -To participate, you must follow these rules: - -- Test only in scope — no attacks on infrastructure or third-party systems -- Do not spam forms or create high-traffic scans -- Do not attempt DoS, phishing, or social engineering -- Do not access or modify other users’ data -- Do not disclose vulnerabilities publicly without our permission - -All tests should be confined to your own accounts or test environments. - ---- - -## Eligibility for Bounties - -To qualify for a reward: -- Be the **first** to report the issue -- Submit only through HackenProof -- Include clear **steps to reproduce** and a **working PoC** -- Do not be a current/former employee or contractor - -> AI-generated reports without a working PoC are **not eligible**. - ---- - -## Coordinated Disclosure - -- **Do not share vulnerabilities publicly**, even after they are resolved -- All communication must go through HackenProof -- Public disclosure will disqualify the report - ---- - -## Resources - -- [Kaia Bounty Program on HackenProof](https://hackenproof.com/companies/kaia) -- [Kaia Documentation](https://docs.kaia.io) - ---- +The program page is the source of truth for scope, severity classification, reward ranges, +and program rules. All communication about a report goes through HackenProof. -Thanks for helping us improve Kaia’s security! We appreciate every responsible disclosure. \ No newline at end of file +Do not test against Kaia Mainnet or Kairos Testnet. Both carry real users and services; run +your research on a local private network.