This repository holds the smart contracts that custody sponsor funds in escrow — exactly the kind of codebase where a security researcher finding a real vulnerability (fund-draining, double-spend, access-control bypass) needs a clear, private channel to report it rather than filing a public GitHub issue that discloses the exploit before it's fixed. There's no SECURITY.md anywhere in the repo defining that channel, expected response times, or scope (e.g. testnet-only vs. any future mainnet deployment). Given the project's own docs/access-control-audit.md and the many already-filed, quite serious security-labeled issues show the team clearly does take this seriously internally, formalizing an external disclosure process (even a minimal one: an email address or a private Security Advisory link) closes an obvious gap for anyone outside the immediate team who finds something.
This repository holds the smart contracts that custody sponsor funds in escrow — exactly the kind of codebase where a security researcher finding a real vulnerability (fund-draining, double-spend, access-control bypass) needs a clear, private channel to report it rather than filing a public GitHub issue that discloses the exploit before it's fixed. There's no
SECURITY.mdanywhere in the repo defining that channel, expected response times, or scope (e.g. testnet-only vs. any future mainnet deployment). Given the project's owndocs/access-control-audit.mdand the many already-filed, quite serious security-labeled issues show the team clearly does take this seriously internally, formalizing an external disclosure process (even a minimal one: an email address or a private Security Advisory link) closes an obvious gap for anyone outside the immediate team who finds something.