DO NOT CREATE A GITHUB ISSUE to report a security problem.
Instead please use this Report a Vulnerability link. Provide a helpful title and detailed description of the problem.
If you haven't done so already, please enable two-factor auth in your GitHub account.
Expect a response as fast as possible in the advisory, typically within 72 hours.
--
If you do not receive a response in the advisory, send an email to security@solana.com with the full URL of the advisory you have created. DO NOT include attachments or provide detail sufficient for exploitation regarding the security issue in this email. Only provide such details in the advisory.
If you do not receive a response from security@solana.com please followup with
the team directly. You can do this in the #core-technology channel of the
Solana Tech discord server, by pinging the admins
in the channel and referencing the fact that you submitted a security problem.
The Solana Foundation offer bounties for critical Solana security issues. Please see the Solana Security Bug Bounties for details on classes of bugs and payment amounts.
Only a subset of programs within the Solana Program Library repo are deployed to the Solana Mainnet Beta. Currently, this includes:
If you discover a critical security issue in an out-of-scope program, your finding may still be valuable.
token-2022 is still under audit and not meant for full production use. In the meantime, all clusters have the latest program deployed for testing and development purposes ONLY.
Many programs, including token-swap and token-lending, have been forked and deployed by prominent ecosystem projects, many of which have their own bug bounty programs.
While we cannot guarantee a bounty from another entity, we can help determine who may be affected and put you in touch with the corresponding teams.
In case an incident is discovered or reported, the Solana Security Incident Response Process will be followed to contain, respond and remediate.