chore: update policy #23

aljo242 · 2025-10-17T21:39:03Z

POLICY.md: Removed prior bug bounty, severity handling, and Patch Day process text; replaced with a single pointer directing readers to SECURITY.md for details.

SECURITY.md:

Replaced brief policy blurb with a full “Cosmos Security Vulnerability Disclosure and Bug Bounty Policy” introduction.
Added private reporting requirements: prefer HackerOne; fallback email security@cosmoslabs.io; email submissions not bounty-eligible; no public disclosure until authorized.
Added bug bounty overview: in-scope components (SDK, CometBFT, IBC, Cosmos EVM, other critical infra); scope/severity/reward details governed by the HackerOne page and Safe Harbor terms.
Added severity classification table (Critical, High, Medium, Low) and reference to resources/CLASSIFICATION_MATRIX.md.
Added silent patch model description, aligned with Ethereum/Bitcoin/Zcash practices; critical issues handled case-by-case with possible private fix distribution or emergency upgrades.
Added fix distribution expectations: patches/minor releases, security implications may be omitted from notes, private notifications to operators possible.
Added disclosure timelines: Low/Medium ~4 weeks after public fix; High after affected version EOL (~1 year typical); Critical case-by-case (at least after EOL).
Added post-disclosure transparency: advisories with impact, affected versions, remediation, and reporter attribution; long-term public availability.
Added references to external security advisory/disclosure resources.

mattac21 · 2025-10-23T17:11:37Z

SECURITY.md

+**Scope:** Core Cosmos Stack components, such as: Cosmos SDK, CometBFT consensus engine, IBC, Cosmos EVM and
+other critical infrastructure
+
+For full scope, severity definitions, and reward ranges, see the Cosmos
+page on HackerOne.


Should probably just list out the exact scope here (instead of leaving it at 'other critical infra'), we also should link to the page on hacker one here.

mattac21 · 2025-10-23T17:13:51Z

SECURITY.md

+| **Critical** | Bugs posing an existential or network-wide threat (chain halts, consensus failures, inflation, or theft). | Token creation beyond fixed supply, permanent fork bug. |
+| **High**     | Major disruption to many nodes or users, often remotely exploitable.                                      | Remote crash or chain halt vulnerability.               |
+| **Medium**   | Moderate impact or harder to exploit; may require specific configurations.                                | Slow block propagation, limited DoS.                    |
+| **Low**      | Minor impact or impractical exploitation.                                                                 | Benign input causing small performance issue.           |


need to expand on these further and be more specific in the definitions between critical and high. this is probably what security researchers care most about, and here critical and high sound very similar, feels like you could argue any high is a critical based on these defs.

mattac21 · 2025-10-23T17:16:24Z

SECURITY.md

+### Advance Notice
+
+Before disclosing, Cosmos issues a **pre-announcement**, e.g.:
+
+> "Upcoming security disclosure: vulnerabilities fixed in Cosmos SDK
+> vX.Y.Z will be publicly disclosed on \[Date\]. Please ensure you have
+> upgraded."
+
+This alerts operators while maintaining security during the embargo.


i dont totally get this part, so we have silent releases, but also will announce that patch x.y.z has a security vulnerability in it that we are fixing and will announce what that is in a year? im assuming for a lot of these the security vuln will be the only thing in the patch if we are upgrading the previous release family, so then based on the commit message + this announcement it feels like it defeats the purpose of it being silent.

srdtrk · 2025-12-12T15:27:38Z

SECURITY.md

+Cosmos adopts a **silent patch** approach. Vulnerabilities are fixed
+quietly before disclosure.


Should mention that this is not for critical vulnerabilities. And also mention what we do in case of critical vulnerabilities

srdtrk · 2025-12-12T15:28:30Z

SECURITY.md

+
+Cosmos adopts a **silent patch** approach. Vulnerabilities are fixed
+quietly before disclosure.
+This mirrors practices from projects like **Ethereum's Geth**, **Bitcoin


Might be good to include a link here to their policy. For ex, https://geth.ethereum.org/docs/developers/geth-developer/disclosures

srdtrk · 2025-12-12T15:39:41Z

SECURITY.md

+Announcing vulnerabilities too early can endanger unpatched nodes.
+Silent fixes allow time for safe upgrades before attackers become aware.


True, I'm curious if we can stick to this if we see a chain get attacked (and let's say get halted). So this doc should mention what we do in case we know that attackers have already become aware before a maintenance release. My guess would be that we treat is as critical, although it is not critical.

srdtrk · 2025-12-12T15:40:04Z

SECURITY.md

+### Disclosure Timeline
+


Duplicate

Suggested change

### Disclosure Timeline

srdtrk · 2025-12-12T15:41:28Z

SECURITY.md

+|------------------|----------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
+| **Low / Medium** | ~4 weeks after public fix release                                          | Publish full advisory with impact and fix details.                                      |
+| **High**         | After the affected version reaches **End-of-Life (EOL)** (~1 year typical) | Delayed high-severity policy ensures attackers are not aware of exploits.               |
+| **Critical**     | **Ad-hoc** (case-by-case)                                                  | Disclose only when safe; may delay or omit full details to prevent future exploitation. |


For this, we would need to patch everyone asap, right? So once that is done, I don't see why we can't wait until the EOL.

vladjdk

aligned

zchn

Looks great to me. Only minor thoughts.

zchn · 2025-12-12T19:55:10Z

SECURITY.md

+
+| **Level**    | **Description**                                                                     | **Examples**                                            |
+|--------------|-------------------------------------------------------------------------------------|---------------------------------------------------------|
+| **Critical** | Network-wide or existential threats, including fund loss, inflation, or theft.     | Unlimited token minting, permanent consensus failure.   |


I'd only include permanent & irrecoverable loss of fund in critical, i.e. Description: "Permanent and irrecoverable loss of fund", Example: "Direct fund loss, unauthorized and unlimited token minting, irreversible theft of fund."

Any DoS issues including chain halt, temporary freeze of funds and recoverable fund loss should be a high only.

zchn · 2025-12-12T20:01:21Z

SECURITY.md

+
+## Vulnerability Severity Levels
+
+Reported vulnerabilities are assigned a severity classification that


What's the motivation of having both this table and the read world examples at https://github.com/cosmos/security/blob/1e9c361558608b4ac5468ffdfff89abd273249be/resources/CLASSIFICATION_MATRIX.md#real-world-examples? Feels like they serve the same purpose so we should probably merge them?

zchn · 2025-12-12T20:02:09Z

SECURITY.md

+
+------------------------------------------------------------------------
+
+## Silent Patch and Disclosure Process


I really like that we are not reinventing the wheel and reusing Eth/Btc/Zcash process as much as possible!

aljo242 added 2 commits October 17, 2025 17:38

update

84ae57a

update

5d07784

mattac21 reviewed Oct 23, 2025

View reviewed changes

aljo242 added 4 commits December 12, 2025 10:08

update

56b6cf1

update

49d929a

remove-confusion

7a920ab

reword

025b6dc

srdtrk reviewed Dec 12, 2025

View reviewed changes

aljo242 added 2 commits December 12, 2025 11:01

update

ee2b9f6

adjusted

1e9c361

vladjdk approved these changes Dec 12, 2025

View reviewed changes

zchn approved these changes Dec 12, 2025

View reviewed changes

fix

92a6507

aljo242 merged commit 3333bcc into main Dec 12, 2025

		Cosmos adopts a silent patch approach. Vulnerabilities are fixed
		quietly before disclosure.

		Announcing vulnerabilities too early can endanger unpatched nodes.
		Silent fixes allow time for safe upgrades before attackers become aware.


		## Vulnerability Severity Levels

		Reported vulnerabilities are assigned a severity classification that


		------------------------------------------------------------------------

		## Silent Patch and Disclosure Process

chore: update policy #23

chore: update policy #23

Conversation

aljo242 commented Oct 17, 2025 • edited by zchn Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vladjdk left a comment

Choose a reason for hiding this comment

Uh oh!

zchn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

6 participants

aljo242 commented Oct 17, 2025 •

edited by zchn

Loading