Security policy
How to report a vulnerability in Nimbus, how to keep the report confidential, and how the team handles reports and bounties.
If you have found a way to break Nimbus, we want to hear it before anyone else does. This page says how to reach us, how to keep the details safe while we work on a fix, and what you can expect from us. Every Nimbus program on Solana points here from its security.txt.
How to report
1. Ask for an encryption key
Email dev@umbraprivacy.com saying that you have a vulnerability to report. Do not include any details of it in this first message. The team replies with a public encryption key, of a stronger standard than ordinary email encryption, and how to use it.
2. Encrypt the report
Write the report and encrypt it with that key before it leaves your machine. Include what is affected, the impact you believe it has, the steps to reproduce it, and a proof of concept. The proof of concept must run on Surfpool, a local fork of Solana mainnet, so the team can reproduce it without touching the live network.
3. Send it over a private channel
Send the encrypted report to the team over a channel that is private and confidential between you and the team, such as an email to dev@umbraprivacy.com or a direct message to a team member on Telegram. Never send it, even encrypted, to a group, a public channel, an issue tracker or a shared document.
Confidentiality
Every report must stay confidential, before and after a fix. Do not share it, or anything that would let someone reconstruct it, with anyone outside the team, and do not send the details unencrypted at any point.
Whether an issue is ever disclosed, and when and how, is solely at Umbra's discretion once it is fixed. Some issues may be kept confidential permanently. Do not disclose any part of a report yourself unless Umbra has agreed to it in writing.
Conditions
- Prove it on Surfpool. Build and run your proof of concept on a Surfpool fork, never against mainnet. Never move, freeze or put at risk funds that are not yours, and never access another user's data.
- Show the issue, do not exploit it. Do no more than you need to demonstrate the problem.
- Do not disrupt the protocol. No denial-of-service, spam or load testing against the programs, services or infrastructure, and no social engineering of the team or of users.
- Leave disclosure to Umbra. Make no disclosure of any kind unless Umbra agrees to it in writing.
- Report in good faith. Do not demand payment as a condition of disclosure, and report each issue once, as soon as you find it.
Bounties
Bounties may be paid at the team's discretion. The team are firm believers in security and act in good faith, so a report that follows this policy and protects users will be taken seriously and rewarded where it merits one. The amount depends on the severity of the issue, the quality of the report and how closely the report followed this policy. A report that breaks these conditions may not be eligible.
What to expect from us
The team acknowledges each report, keeps you updated while it is investigated and fixed, and, if you wish and the issue is disclosed, credits you.
Related
Last updated