Skip to content
Foundation

Foundation

Security

Responsible disclosure, audits and advisories for the Zroarus Testnet.

Found something? Report it privately through the form below. Please do not post exploits publicly before a fix ships.

01 / How disclosure works

  1. Report privately

    Submit the form below with what you found, how to reproduce it and the impact you see.

  2. Triage

    Security staff, separate from the other Foundation teams, review and assess the report.

  3. Fix

    The issue is fixed and affected parties are given time to upgrade.

  4. Advisory

    After the fix ships, an advisory is published with severity, affected versions and the fix.

02 / Scope

What the Foundation's security program covers.

In scope

The Foundation's web properties and API, the staff console, and Testnet infrastructure operated by the Foundation.

Out of scope

Third-party services, social engineering of staff, denial-of-service testing and anything that accesses data that is not yours.

03 / Report a vulnerability

Private intake, triaged by security staff. Never post exploits publicly before a fix ships.

Never post exploits publicly before a fix ships. Reports are visible to security staff only.

04 / Security audits

Independent audits commissioned by the Foundation, with scope and date.

No audits published yet

Completed audit reports will be listed here with scope and auditor.

05 / Advisories

Fixed issues are disclosed here as advisories with severity, affected versions, and the fix. Unresolved vulnerabilities are never published — advisories appear only after a fix ships and affected parties have had time to upgrade.

No advisories published

A clean slate so far — fixed-issue advisories will be listed here when they exist.