This policy applies to every ObolNetwork repository that does not have its own SECURITY.md.
Please do not open a public issue, pull request or discussion for a security problem.
Email security@obol.tech with:
- the affected repository, component and version
- steps to reproduce, or a proof of concept
- the impact you expect
Send reports in plain text, with any proof of concept attached. We aim to reply within 48 hours.
Valid reports in scope can earn a reward. Scope, rules and rewards are in the Obol Bug Bounty Program.
- Our full security process and responsible disclosure standard: obol-security
- Audit reports: docs.obol.org
- security.txt: https://obol.org/.well-known/security.txt