From e5b82b899535353786f686a374e7ca13906e9b42 Mon Sep 17 00:00:00 2001 From: ArtyormSatori Date: Thu, 24 Sep 2026 11:34:09 +0700 Subject: [PATCH] feat(security): update security policy with bug bounty program and reward matrix - Add formal bug bounty reward tiers (Critical to Low) based on CVSS v3.1 - Detail private vulnerability disclosure channels via GitHub Advisory and email - Outline supported components, in-scope/out-of-scope boundaries, and safe harbor - Establish triage response times and SLA commitments Closes #1310 --- SECURITY.md | 80 ++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 58 insertions(+), 22 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 88e963b6..bcd12cc3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,34 +1,70 @@ -# Security Policy +# Security Policy & Bug Bounty Program + +Trivela is committed to maintaining the highest security standards for financial safety, reserve integrity, smart contract execution, and backend data protection. We operate a formal bug bounty program and deeply appreciate responsible vulnerability disclosure from security researchers. + +--- ## Supported Versions -| Version | Supported | -| ------- | ------------------ | -| main | :white_check_mark: | +| Component / Branch | Supported Versions | Security Status | +| :--- | :--- | :--- | +| `main` (Production Branch) | Current Release | :white_check_mark: Active Security Maintenance | +| Soroban Contracts (`/contracts/`, `/soroban/`) | `>= 0.8.0` | :white_check_mark: Active Audit & Hotfix Coverage | +| Backend Services (`/backend/`) | `>= 1.0.0` | :white_check_mark: Active Security Maintenance | +| Client SDK & Frontend (`/sdk/`, `/frontend/`) | Current Release | :white_check_mark: Active Security Maintenance | +| Legacy / Deprecated Branches | Prior Releases | :x: Unsupported (Upgrade Required) | + +--- ## Reporting a Vulnerability -If you discover a security vulnerability in Trivela, please report it -responsibly: +If you discover a security vulnerability in Trivela, please report it responsibly. **Do NOT** open a public GitHub issue or pull request before the vulnerability is resolved. + +### Reporting Channels +1. **GitHub Private Security Advisory**: Open a private draft at [Trivela Security Advisories](https://github.com/FinesseStudioLab/Trivela/security/advisories/new). +2. **Encrypted Security Email**: Contact the security team at **`security@finessestudiolab.com`** with subject line `[SECURITY DISCLOSURE] `. + +### Report Requirements +To help us triage and validate your report swiftly, please provide: +- Detailed description of the vulnerability and its potential attack vector. +- Step-by-step reproduction instructions or a minimal reproducible Proof of Concept (PoC). +- Impact assessment on funds, reserves, authentication tokens, or contract state. +- Suggested architectural remediation or defensive patch (if available). + +--- -1. **Do NOT** open a public GitHub issue. -2. Email **security@finessestudiolab.com** with: - - A description of the vulnerability - - Steps to reproduce - - Impact assessment -3. You will receive an acknowledgement within 48 hours. -4. We will work with you to understand and address the issue before any - public disclosure. +## Bug Bounty Reward Program -## Scope +We offer structured financial rewards for verified vulnerabilities based on CVSS v3.1 severity scores and financial impact on the ecosystem: +| Severity Tier | CVSS v3.1 Score | Impact Scope | Reward Tier (USD / Equivalent) | +| :--- | :--- | :--- | :--- | +| **Critical** | `9.0 – 10.0` | Direct theft/drain of user/reserve funds, arbitrary contract balance takeover, critical auth bypass | **$2,500 – $5,000+** | +| **High** | `7.0 – 8.9` | Contract execution halt causing fund lockup, privilege escalation to admin/signer, sensitive credential leak | **$1,000 – $2,500** | +| **Medium** | `4.0 – 6.9` | Gas/rent exhaustion attacks, logic flaws bypassing defensive limits, unauthorized access to user metadata | **$300 – $1,000** | +| **Low / Informational** | `0.1 – 3.9` | Minor information disclosure, non-exploitable edge-case inconsistencies, defensive hardening | **$100 – $300** | + +--- + +## Scope & Safe Harbor + +### In-Scope - Smart contracts (`/contracts/`, `/soroban/`) -- Backend API (`/backend/`) -- SDK and client libraries (`/sdk/`) -- Frontend application (`/frontend/`) +- Backend API and auth middleware (`/backend/`) +- SDK and cryptographic signing libraries (`/sdk/`) +- Frontend application boundaries (`/frontend/`) + +### Out-of-Scope +- Denial of Service (DoS/DDoS) targeting public endpoints without state corruption +- Social engineering, phishing, or physical attacks +- Issues in third-party RPC providers or external node infrastructure + +### Safe Harbor +Trivela will not pursue legal action against security researchers who report vulnerabilities in good faith and adhere to responsible disclosure principles. -## Bug Bounty +--- -We do not currently operate a formal bug bounty programme, but we -appreciate responsible disclosures and will credit reporters in our -release notes (with permission). +## SLA & Response Time +- **Initial Acknowledgment**: Within **24 to 48 hours**. +- **Triage & Validation**: Within **5 business days**. +- **Fix Deployment & Bounty Payout**: Immediate post-validation and coordinated release.