Tell Us What You Found, And We Will Answer
A researcher who finds something in a settlement network needs a route that is obvious and a response that is predictable. This page is both. Report in good faith, within the boundaries below, and we will not pursue you for it.
[email protected]In scope
- •swss.io and every page on it
- •app.swss.io, the member application
- •whitepaper.swss.io, docs.swss.io and devhub.swss.io
- •swssscan.swss.io and testnet.swssscan.swss.io
- •The public RPC endpoints for mainnet 122605 and testnet 122606
- •Smart contracts deployed to either public network
Out of scope
- •Anything requiring physical access, or access to an employee's device
- •Social engineering of staff, contractors or support
- •Reports generated by an automated scanner with no demonstrated impact
- •Missing headers or configuration findings with no path to exploitation
- •Denial of service, volumetric testing, and anything that degrades a service for others
- •Third party services SWSS consumes but does not operate
Four things never to do
The protection offered above depends on these. A report that required one of them to produce is a report we cannot treat as made in good faith.
- 1Do not access, modify or retain data belonging to anyone else. If a proof requires somebody's data, stop and describe the path instead.
- 2Do not run denial of service tests of any kind, against any SWSS host or network.
- 3Do not test against mainnet 122605 where testnet 122606 would demonstrate the same thing.
- 4Do not publish a finding, in any forum, before it is resolved and we have agreed a date.
What happens next
We acknowledge every report. You will hear whether it is reproduced, and you will hear when it is fixed, rather than hearing nothing and assuming.
What to send
What you did, what happened, and what an attacker could do with it. A short reproduction beats a long scanner report every time.
Credit
Researchers are credited by name on resolution where they want to be, and never named without being asked.