Security Policy

Quantus takes the security of our users seriously and welcomes reports from security researchers.

Please do not open a public issue, pull request, or social-media post for a security vulnerability. Public disclosure before a fix is available puts users' funds at risk. Use the private channel below and we will coordinate a fix and disclosure with you.

• A clear description of the issue and its security impact.
• A working proof of concept is required. It must run directly against this project, using a release build or locally built version, and demonstrate the reported behavior and security impact. Standalone code, mathematical examples, or simulations that only reproduce the theory without exercising the project do not satisfy this requirement.
• Step-by-step reproduction instructions.
• Affected platforms and versions.
• Any relevant logs, addresses, or transaction IDs (for on-chain issues).
• If you used AI tooling to find or write up the report, please say so.

We consider security research conducted in good faith under this policy to be authorized. We will not pursue or support legal action against researchers who:

• make a good-faith effort to avoid privacy violations, data destruction, and interruption or degradation of our services;
• only interact with accounts they own or have explicit permission to access; and
• give us a reasonable opportunity to fix an issue before disclosing it publicly.

In scope: any repository in the quantus-network organization — anything that could lead to loss of funds, exposure of keys or seeds, consensus failure, a failed or incorrect transaction, or compromise of our services or users.

Out of scope: issues in third-party services or nodes we do not operate; reports generated solely by automated scanners without a demonstrated impact; low-severity or informational issues on our marketing and landing websites; and social-engineering or physical attacks.

There is no fixed bounty and no guaranteed payout; whether a report qualifies, and any amount, are determined solely by Quantus.

Only the latest release is supported; security fixes are delivered in new versions. Please keep your installation up to date.