This is the default policy for FLOP Labs repositories that do not publish their own. A repository with its own SECURITY.md overrides this one — read that instead.

Open a private security advisory from the repository's Security tab → Report a vulnerability. It keeps the report private until there is a fix, and it is the channel that reaches us fastest. Please do not open a public issue for anything exploitable.

Filing one needs a GitHub account, signed in. Without one — or to send PGP — mail security@flop.finance.

If the Security tab offers no Report a vulnerability button, private reporting is not enabled on that repository. Use the email address above. As a last resort, open a public issue saying exactly that and nothing about the finding — that reports a broken channel, not the bug.

What you did, what you expected, and what happened instead. A reproduction we can run — a curl, a failing test, a transaction — is usually the whole report. Tell us the commit or release you tested.

Expect an acknowledgement within a few working days. There is no bounty programme.

Anything in a FLOP Labs repository. Note that several repositories are forks of upstream projects (zkVerify, rusty-kaspa, dstack); if the bug is in unmodified upstream code, please report it upstream as well, and say so — it helps us judge urgency.

Devnet and testnet deployments carry no value and are expected to be unstable. Findings there are still welcome, but treat availability issues as low severity.