Security policy

Report a vulnerability

• Email dev@kintsu.xyz. Include what you found, where (URL, contract address, file and line), how to reproduce it, and how to reach you.
• For anything that puts user funds at risk right now, also contact SEAL 911, a Security Alliance responder line that can reach us at any hour.
• Please do not open a public issue or post about a security report before it is fixed.

We acknowledge reports within 24 hours and keep you updated until the issue is resolved. We will credit you in the fix notes if you want.

Scope

In scope: kintsu.xyz and www.kintsu.xyz, and the Kintsu protocol contracts on Monad and Canton.

Out of scope: third-party services we use (Vercel, Supabase, Cloudflare, PostHog) unless the issue is in our configuration of them; social engineering of our team; denial of service.

Safe harbor

If you follow this policy, act in good faith, avoid privacy violations and service disruption, and do not exploit a finding beyond what is needed to demonstrate it, we will not pursue legal action against you and will work with you to understand and resolve the issue quickly.

Machine-readable version: /.well-known/security.txt