---
title: "Security and responsible disclosure | ZooBC Foundation"
description: "Responsible disclosure to the ZooBC Foundation: how to report a security issue in the blockchain or this site, what to expect, and the audit status."
url: https://zoobc.foundation/security/
language: en
publisher: ZooBC Foundation
retrieved: 2026-10-19
---

Security

# Responsible disclosure.

If you believe you've found a security issue affecting the ZooBC network, this site, or the Foundation's programmes, tell us. This page describes how — and what we commit to in return.

Primary contact

## [security.disclosure@zoobc.foundation](mailto:security.disclosure@zoobc.foundation)

Please describe the issue, the affected surface (network, wallet, explorer, this site, or a Foundation programme), reproduction steps, and any concurrent public exposure. A PGP key is not yet published — `/.well-known/security.txt` carries no `Encryption:` field — so if you need to encrypt, ask for a key at that address first.

## What we commit to

- **Acknowledgement within 72 hours** of receipt at the disclosure address above.
- **A named point of contact** at the Foundation for the duration of the investigation.
- **Coordinated disclosure.** We will agree an embargo window with the reporter; we will not publish before it, and we will not push it out arbitrarily.
- **Public credit** on the report timeline unless the reporter prefers anonymity.
- **No legal action** against good-faith researchers who follow this policy and stay within the scope below.

## In scope

- The `zoobc.foundation` website and its backend.
- Foundation grant workflows and the applicant/reviewer surfaces.
- Handoff between this site's authentication and Sippis identity — insofar as any bug enables cross-account access or elevation.

Issues affecting the ZooBC network protocol, node software, or the release registry should also be reported here, and we will route them to the responsible engineering team (Blockchain Zoo PTE. LTD. or another party depending on the surface) under the same coordinated disclosure terms.

## Out of scope

- Volumetric denial-of-service against public endpoints — please don't.
- Social engineering against Foundation staff or grantees.
- Physical intrusion into any infrastructure.
- Issues affecting third-party sites that merely link to ours.

## Bug bounty

A formal, paid bug-bounty programme is planned as part of the **Bug bounties and security** genesis allocation slice (see [Transparency](https://zoobc.foundation/transparency/)). Terms, scope, and payout schedule will be published on this page when the programme opens. Until then, good-faith researchers who find something material through the disclosure channel above will be credited publicly and considered for retroactive recognition when the programme launches.

## Audit status

**No external audit has been commissioned yet.** Stating this plainly is deliberate — implying an audit exists that does not would defeat the entire point of a transparency-first foundation. When an audit firm is engaged, the engagement letter, scope, and findings summary will be published here with a link to the full report.

In the meantime, the strongest verification you can perform yourself is against the on-chain **release registry**: every published binary has its hash written to consensus. See [Transparency](https://zoobc.foundation/transparency/) and [/verify](https://zoobc.network/verify).

---

Source: https://zoobc.foundation/security/  
All pages: https://zoobc.foundation/llms.txt  
Full text: https://zoobc.foundation/llms-full.txt