> For the complete documentation index, see [llms.txt](https://docs.transientlabs.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.transientlabs.xyz/miscellaneous/responsible-vulnerability-disclosure.md). # Responsible Vulnerability Disclosure ### Overview At Transient Labs, we take the security of our platform, smart contracts, and users seriously. We welcome responsible disclosures from security researchers who identify vulnerabilities that could compromise the security of our systems or assets. Our vulnerability disclosure program is intended to identify genuine security vulnerabilities with demonstrable security impact. It is not a general-purpose bug reporting program or a channel for product design feedback. **Transient Labs does not currently operate a public bug bounty program.** Financial rewards are not guaranteed or expected for submitted reports. We may, at our sole discretion, recognize researchers who disclose significant security vulnerabilities. ### Reporting a Vulnerability If you believe you have identified a security vulnerability, please submit your findings to [**dev@transientlabs.xyz**](mailto:dev@transientlabs.xyz). Reports should include: * A clear description of the vulnerability. * The affected contract, endpoint, or application. * Steps to reproduce the issue and a proof of concept, where applicable. * A realistic attack scenario explaining the prerequisites for exploitation. * A description of the demonstrated security impact. We prioritize reports involving unauthorized access, privilege escalation, theft or permanent freezing of assets, and other meaningful violations of security boundaries. Demonstrating unexpected behavior alone does not necessarily establish a security vulnerability. Reports should explain how the behavior creates a concrete security risk. ### Assets in Scope The following assets are covered by this disclosure policy: **Smart Contracts** * * * **Websites & Applications** * [https://transient.xyz](https://transient.xyz/) * [https://transientlabs.xyz](https://transientlabs.xyz/) ### Out of Scope The following generally fall outside the scope of this program unless a distinct, demonstrable security vulnerability is established: * General software bugs without meaningful security impact. * Product design disagreements, feature requests, or alternative implementation preferences. * Intended functionality operating within documented system behavior and trust assumptions. * Security best-practice recommendations and defense-in-depth improvements without demonstrated exploitability. * Theoretical attack scenarios without a credible exploitation path or demonstrated impact. * Previously reported or already known vulnerabilities without materially new security impact. * Issues dependent on privileged access, compromised credentials, or third-party systems without an independently demonstrated vulnerability. * Issues involving non-standard or maliciously implemented token contracts outside supported trust assumptions. * Automated scanner findings without independent verification and demonstrated security impact. * UI/UX issues and temporary functional disruptions without meaningful security consequences. We generally reference the [Immunefi Vulnerability Severity Classification System V2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/) and its applicable exclusions when assessing security impact. ### Responsible Testing Guidelines Security researchers must conduct testing responsibly and avoid causing harm to our users, infrastructure, or assets. The following activities are prohibited: * Testing against live mainnet or public testnet deployments. Smart contract testing must be performed using local forks or isolated environments. * Accessing, modifying, or exposing data belonging to other users. * Exploiting vulnerabilities beyond what is necessary to demonstrate their existence. * Denial-of-service attacks or high-volume automated testing. * Phishing, social engineering, or attacks targeting employees or users. * Testing third-party systems or services without authorization. * Publicly disclosing unremediated vulnerabilities without prior coordination. Researchers should act in good faith, minimize potential impact, and promptly report any vulnerabilities discovered. ### Review Process We appreciate the efforts of security researchers who contribute to the safety of our ecosystem. Reports are reviewed as resources permit, with priority given to submissions demonstrating credible and significant security impact. **We cannot guarantee individual responses, status updates, or detailed evaluations of every submission.** We may contact researchers for additional information or clarification when necessary. Submission of a report does not obligate Transient Labs to provide compensation, implement a proposed change, or engage in ongoing correspondence. ### Recognition & Rewards Transient Labs does not offer guaranteed financial compensation for vulnerability disclosures. At our sole discretion, we may recognize or reward researchers who identify significant security vulnerabilities. Any such recognition is voluntary and does not establish an expectation of future compensation. ### Contact Please send responsible security disclosures to [**dev@transientlabs.xyz**](mailto:dev@transientlabs.xyz). We appreciate your contributions to keeping Transient Labs and its users secure.