Report security vulnerabilities privately to:
- Email:
security@finchippay.dev - PGP Key:
docs/security/pgp-key.asc(coming soon)
Do not open a public issue for security vulnerabilities.
| Severity | Acknowledgment | Patch Release |
|---|---|---|
| Critical (direct loss of funds) | 24 hours | 7 days |
| High (potential loss, complex exploit) | 48 hours | 14 days |
| Medium (service disruption, info leak) | 1 week | 30 days |
| Low (minor issues) | 2 weeks | Next release |
The following are in scope for vulnerability reports:
- Smart contract (
contracts/finchippay-contract/) - Backend API (
backend/src/) - Frontend application (
frontend/) - SDK (
sdk/)
We maintain a bug bounty program. Rewards range from $50–$25,000 depending on severity.
Contact security@finchippay.dev for details.
- Smart contract: Checked arithmetic, TTL management, emergency pause, M-of-N admin
- Backend: JWT auth, rate limiting, Helmet headers, SQL injection prevention, input validation
- Frontend: CSP headers, encrypted local storage, no private key exposure
- Infrastructure: Container scanning (Trivy), dependency auditing, SBOM generation
See docs/audits/ and docs/SECURITY_AUDIT_FRAMEWORK.md.
We follow a coordinated disclosure process:
- Reporter submits vulnerability
- We acknowledge within published timeline
- We develop and test a fix
- We release the fix and publish an advisory
- We credit the reporter (unless they prefer anonymity)