Skip to content

Commit

Permalink
Update SECURITY.md
Browse files Browse the repository at this point in the history
  • Loading branch information
iamnathanwindsor authored Sep 21, 2024
1 parent e0844db commit 809bcc5
Showing 1 changed file with 36 additions and 18 deletions.
54 changes: 36 additions & 18 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,36 +13,54 @@ The SLIDE SDK has been audited by Oak Security. You can view the full audit repo
| Main Branch | 🏄‍♀️ 🛝 [v1.0.0](https://github.com/LandslideNetwork/slide-sdk/releases/tag/v1.0.0) |

Security vulnerabilities should be reported if they can be reproduced on either the latest release or the main branch.
🕵️‍♂️ Calling All Haters with Benefits!

## 🕵️‍♂️ Calling All Haters with Benefits!

Found a bug? Don't just hate, participate! Here's how you can help us hang ten and keep Slide SDK secure:

Public Reporting: Since we're riding the testnet waves, we're open to public vulnerability reports. Feel free to open an issue on our GitHub repo with the tag [SECURITY]. This helps us build a transparent and collaborative security culture.
Sensitive Issues: For vulnerabilities that might have severe implications even on testnet (like potential economic exploits or privacy breaches), please email us at security@landslidelabs.org with the subject "Confidential Hater's Bug Report: [Brief Description]".
Details, dude: Whether public or private, give us the 411 on the bug. Include reproduction steps and all the juicy details.
Collaboration: Let's ride this wave together. We might need more info, so stay tuned and be ready to dive deeper into the issue with us.
Responsible Disclosure: For email reports, keep it on the down-low until we give the all-clear. For public issues, we'll work together in the open, but avoid sharing exploit details that could be misused.
1. **Public Reporting**: Since we're riding the testnet waves, we're open to public vulnerability reports. Feel free to open an issue on our GitHub repo with the tag [SECURITY]. This helps us build a transparent and collaborative security culture.
2. **Sensitive Issues**: For vulnerabilities that might have severe implications even on testnet (like potential economic exploits or privacy breaches), please email us at security@landslidelabs.org with the subject "Confidential Hater's Bug Report: [Brief Description]".
3. **Details, dude**: Whether public or private, give us the 411 on the bug. Include reproduction steps and all the juicy details.
4. **Collaboration**: Let's ride this wave together. We might need more info, so stay tuned and be ready to dive deeper into the issue with us.
5. **Responsible Disclosure**: For email reports, keep it on the down-low until we give the all-clear. For public issues, we'll work together in the open, but avoid sharing exploit details that could be misused.

Remember, while we're stoked about open collaboration, we reserve the right to remove or edit any reports that we feel could pose an immediate risk to our gnarly community.
🏆 Rewards for Rad Haters

## 🏆 Rewards for Rad Haters

For verified, radical bug finds, we're dishing out SLIDE tokens faster than a surfer catches a wave! The bigger the wipeout you help us avoid, the more tokens you'll slide into.
Bug SeverityRewardCritical$10,000 in SLIDE + 🏆High$5,000 in SLIDE + 🥈Medium$2,500 in SLIDE + 🥉Low$1,000 in SLIDE + 🤙
🤙 Surfer's Code of Conduct

| Bug Severity | Reward |
|--------------|----------------------------|
| Critical | $10,000 in SLIDE + 🏆 |
| High | $5,000 in SLIDE + 🥈 |
| Medium | $2,500 in SLIDE + 🥉 |
| Low | $1,000 in SLIDE + 🤙 |

## 🤙 Surfer's Code of Conduct

We require all our rad researchers to:

Abide by this policy and be mindful about sharing vulnerability info responsibly.
Make every effort to avoid privacy violations, disruption to our gnarly systems, and destruction of data.
Keep vulnerability info confidential if reported via email, until we've caught and surfed that bug.
Avoid posting personally identifiable information, privately or publicly.
- Abide by this policy and be mindful about sharing vulnerability info responsibly.
- Make every effort to avoid privacy violations, disruption to our gnarly systems, and destruction of data.
- Keep vulnerability info confidential if reported via email, until we've caught and surfed that bug.
- Avoid posting personally identifiable information, privately or publicly.

If you follow these guidelines when reporting an issue to us, we commit to:

Not pursue or support any legal action related to your research on this vulnerability.
Work with you to understand, resolve, and ultimately disclose the issue in a timely fashion.
- Not pursue or support any legal action related to your research on this vulnerability.
- Work with you to understand, resolve, and ultimately disclose the issue in a timely fashion.

## 🚫 No Bad Vibes Zone

🚫 No Bad Vibes Zone
While we love our Haters (with Benefits), we keep it cool here. Hate speech or any form of discrimination won't be tolerated and will be wiped out faster than a kook on a big wave. Let's keep our community respectful and inclusive dudes!
🌴 More Info

## 🌴 More Info

As we continue to ride the testnet waves, we're constantly improving our security processes. Stay tuned for more detailed information on our disclosure timeline, process, and examples of vulnerabilities we're particularly interested in.
🏄‍♂️ Transition to Mainnet

## 🏄‍♂️ Transition to Mainnet

Heads up, beach bums! This open policy is specific to our testnet phase. As we paddle towards mainnet, we'll be updating our security policy to ensure we're ready for the big leagues. Stay tuned for updates!

Stay groovy, stay secure! Slide on board, dudes! 🏄‍♂️🌊🛹

0 comments on commit 809bcc5

Please sign in to comment.