Security
Report a vulnerability
How to tell us about a security problem privately, and what happens after you do.
If you believe you have found a security problem in Humanity Ledger or Ledger Chat, we want to hear about it before anyone else does.
How to report
Use a private channel
Report through GitHub private vulnerability reporting, or email [email protected]. Please do not open a public issue.
Tell us how to reproduce it
The affected page or endpoint, the steps you took, what you expected and what happened. A short proof of concept helps.
Give us time to fix it
Please keep the details private until a fix is released or until we have agreed a date with you.
What you can expect from us
- A reply confirming we have your report.
- Updates while we investigate and fix it.
- Credit in the changelog and on the audits page, if you would like it.
Guidelines
- Test only against accounts you own or have permission to use.
- Do not access, change or delete other people's data, and stop as soon as you see data that is not yours.
- Do not run tests that degrade the service for others, such as load or spam tests.
We do not run a paid bounty programme yet. If that changes, this page will say so first.