Security
Responsible disclosure.
If you believe you've found a security issue affecting the ZooBC network, this site, or the Foundation's programmes, tell us. This page describes how — and what we commit to in return.
Primary contact
security.disclosure@zoobc.foundation
Please describe the issue, the affected surface (network, wallet, explorer, this site, or a Foundation programme), reproduction steps, and any concurrent public exposure. A PGP key is not yet published — /.well-known/security.txt carries no Encryption: field — so if you need to encrypt, ask for a key at that address first.
What we commit to
- Acknowledgement within 72 hours of receipt at the disclosure address above.
- A named point of contact at the Foundation for the duration of the investigation.
- Coordinated disclosure. We will agree an embargo window with the reporter; we will not publish before it, and we will not push it out arbitrarily.
- Public credit on the report timeline unless the reporter prefers anonymity.
- No legal action against good-faith researchers who follow this policy and stay within the scope below.
In scope
- The
zoobc.foundationwebsite and its backend. - Foundation grant workflows and the applicant/reviewer surfaces.
- Handoff between this site's authentication and Sippis identity — insofar as any bug enables cross-account access or elevation.
Issues affecting the ZooBC network protocol, node software, or the release registry should also be reported here, and we will route them to the responsible engineering team (Blockchain Zoo PTE. LTD. or another party depending on the surface) under the same coordinated disclosure terms.
Out of scope
- Volumetric denial-of-service against public endpoints — please don't.
- Social engineering against Foundation staff or grantees.
- Physical intrusion into any infrastructure.
- Issues affecting third-party sites that merely link to ours.
Bug bounty
A formal, paid bug-bounty programme is planned as part of the Bug bounties and security genesis allocation slice (see Transparency). Terms, scope, and payout schedule will be published on this page when the programme opens. Until then, good-faith researchers who find something material through the disclosure channel above will be credited publicly and considered for retroactive recognition when the programme launches.
Audit status
No external audit has been commissioned yet. Stating this plainly is deliberate — implying an audit exists that does not would defeat the entire point of a transparency-first foundation. When an audit firm is engaged, the engagement letter, scope, and findings summary will be published here with a link to the full report.
In the meantime, the strongest verification you can perform yourself is against the on-chain release registry: every published binary has its hash written to consensus. See Transparency and /verify.