Skip to content

Commit 5c5c7f1

Browse files
brooksdevon001-starbrooksdevon001-star
authored
Add security disclosure policy (#111)
- Add reference/security-disclosure.mdx with full policy: contact, in-scope, response SLA, severity definitions, coordinated disclosure terms, safe-harbor, and bounty table - Add SECURITY.md for repo root with summary and link to full doc - Register reference/security-disclosure in docs.json navigation
1 parent 33ec556 commit 5c5c7f1

3 files changed

Lines changed: 194 additions & 0 deletions

File tree

‎SECURITY.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Security
2+
3+
Wraith Protocol handles stealth-address key material and private payments across multiple blockchains. We take security seriously and welcome responsible disclosure from the security community.
4+
5+
## Reporting a Vulnerability
6+
7+
**Email:** security@usewraith.xyz
8+
9+
Please do **not** open a public GitHub issue, post on social media, or discuss the finding publicly until a fix has shipped and coordinated disclosure has been agreed with us.
10+
11+
If your report contains sensitive proof-of-concept material, use PGP. Our public key is at https://usewraith.xyz/.well-known/security.txt.
12+
13+
## Response
14+
15+
| Milestone | Target |
16+
|---|---|
17+
| Acknowledgment | 1 business day |
18+
| Initial triage | 3 business days |
19+
| Fix timeline communicated | 7 business days |
20+
| Patch for critical / high | 14 days |
21+
| Patch for medium | 45 days |
22+
| Patch for low | 90 days |
23+
24+
## Safe Harbor
25+
26+
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith under this policy. We consider good-faith security research under this policy to be authorized and will not treat it as a violation of our terms of service.
27+
28+
## Rewards
29+
30+
We operate a discretionary USDC bug bounty:
31+
32+
| Severity | Range |
33+
|---|---|
34+
| Critical | $5,000 – $20,000 |
35+
| High | $1,000 – $5,000 |
36+
| Medium | $250 – $1,000 |
37+
| Low | $0 – $250 |
38+
39+
## Full Policy
40+
41+
Complete details — scope, severity definitions, coordinated disclosure terms, safe-harbor language, reward criteria, and what to include in a report — are in our security disclosure policy:
42+
43+
**https://docs.usewraith.xyz/reference/security-disclosure**

‎docs.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@
8989
},
9090
{
9191
"group": "Contracts",
92+
"pages": ["contracts/evm", "contracts/stellar", "contracts/solana", "contracts/ckb", "reference/stellar-event-schemas"]
93+
},
94+
{
95+
"group": "Reference",
96+
"pages": ["reference/security-disclosure"]
9297
"pages": ["contracts/evm", "contracts/stellar", "contracts/solana", "contracts/ckb", "reference/stellar-event-schemas", "reference/threat-model"]
9398
}
9499
]

‎reference/security-disclosure.mdx‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
---
2+
title: "Security Disclosure Policy"
3+
description: "How to report vulnerabilities in Wraith Protocol responsibly"
4+
---
5+
6+
Wraith Protocol handles private payments and stealth-address key material across multiple blockchains. Security is not a feature — it is the foundation. If you find a vulnerability, we want to hear from you quickly and privately, and we will treat you fairly in return.
7+
8+
## Contact
9+
10+
Email all security reports to **security@usewraith.xyz**.
11+
12+
Use PGP if the report contains sensitive proof-of-concept material. Our public key is available at [https://usewraith.xyz/.well-known/security.txt](https://usewraith.xyz/.well-known/security.txt).
13+
14+
Do not open a public GitHub issue, post on social media, or discuss the finding in any public forum until a fix has shipped and coordinated disclosure has been agreed.
15+
16+
## Scope
17+
18+
### In Scope
19+
20+
The following components are covered by this policy:
21+
22+
| Component | Examples |
23+
|---|---|
24+
| TEE server and key derivation | `packages/tee`, DStack integration, Intel TDX attestation |
25+
| Smart contracts | EVM `StealthAnnouncer`, Stellar Soroban contracts, Solana Anchor programs, CKB lock scripts |
26+
| SDK | `@wraith-protocol/sdk`, crypto primitives, stealth address generation/scanning |
27+
| API server | HTTP endpoints, authentication, agent management |
28+
| Protocol-level cryptography | ECDH key exchange, view tags, meta-address derivation |
29+
30+
Bugs in third-party dependencies (e.g., viem, stellar-sdk, @solana/web3.js) are in scope if Wraith uses the vulnerable code path in a way that creates a real risk to users. Please disclose to the upstream project in parallel.
31+
32+
### Out of Scope
33+
34+
The following are not covered:
35+
36+
- Theoretical attacks without a realistic exploit path
37+
- Social engineering or phishing against Wraith staff
38+
- Denial-of-service via resource exhaustion (unless it can drain user funds or expose keys)
39+
- UI bugs with no security impact (broken layouts, missing copy, display errors)
40+
- Findings from automated scanners submitted without manual validation
41+
- Reports that duplicate a previously reported, known, or already-patched issue
42+
- Issues in infrastructure we do not control (RPC providers, cloud providers, Phala Network itself)
43+
44+
If you are unsure whether something qualifies, email us and ask — we would rather triage a borderline report than miss a real one.
45+
46+
## Response SLA
47+
48+
We treat security reports as highest priority. Our commitments from the moment your email arrives:
49+
50+
| Milestone | Target |
51+
|---|---|
52+
| Acknowledgment | 1 business day |
53+
| Initial triage and severity assessment | 3 business days |
54+
| Fix timeline communicated to reporter | 7 business days |
55+
| Patch shipped for critical / high severity | 14 days |
56+
| Patch shipped for medium severity | 45 days |
57+
| Patch shipped for low severity | 90 days |
58+
59+
If we cannot meet a deadline we will tell you proactively and explain why. For issues under active exploitation we will move faster than these targets.
60+
61+
## Severity Definitions
62+
63+
We use a simplified four-level scale aligned with CVSS v3.
64+
65+
| Severity | Definition |
66+
|---|---|
67+
| **Critical** | Remote key exfiltration, arbitrary fund theft, TEE bypass, complete loss of privacy across all users |
68+
| **High** | Partial key leakage, targeted fund theft, stealth-address deanonymization for a specific user |
69+
| **Medium** | Limited information disclosure, integrity violation without direct fund loss, privacy degradation requiring unusual conditions |
70+
| **Low** | Minor information leakage, requires physical access or already-compromised machine, no realistic path to fund loss |
71+
72+
## Coordinated Disclosure
73+
74+
We follow a 90-day coordinated disclosure window, starting from the date we confirm receipt of a complete, reproducible report.
75+
76+
- After the patch ships, we will coordinate the public disclosure date with you.
77+
- If a patch ships early, we will offer to publish the advisory sooner at your preference.
78+
- If 90 days pass without a patch for reasons outside your control, you may disclose and we will not pursue any legal or reputational action against you.
79+
- We may ask for a short extension (up to 14 days) if the fix is nearly complete. We will not ask more than once.
80+
- For critical vulnerabilities under active exploitation, we reserve the right to publish an advisory and mitigation advice before a full patch is ready, with or without technical details.
81+
82+
## Safe Harbor
83+
84+
Wraith Protocol will not initiate legal action against researchers who:
85+
86+
1. Discover and report vulnerabilities following this policy in good faith.
87+
2. Avoid accessing, modifying, or exfiltrating user data beyond what is necessary to demonstrate the vulnerability.
88+
3. Do not exploit the vulnerability for personal gain, cause harm to users, or disrupt live systems.
89+
4. Do not publicly disclose the vulnerability before the agreed disclosure date.
90+
5. Comply with applicable laws.
91+
92+
We will work with researchers to understand findings and will not treat good-faith research as a violation of our terms of service. If a third party initiates legal action related to your security research conducted under this policy, we will make clear that your research was conducted in accordance with it.
93+
94+
Wraith does not run a "no testing permitted" policy on all production infrastructure. However:
95+
96+
- Do not perform testing against wallets or agents that you do not own or control.
97+
- Do not attempt to access, modify, or delete other users' data.
98+
- Do not exfiltrate any user funds or private key material from production.
99+
- Use testnet environments for proof-of-concept work wherever possible.
100+
101+
## Recognition and Rewards
102+
103+
We publicly credit researchers (with their permission) in our security advisories and in the changelog entry for the fix. If you prefer to remain anonymous, we will respect that.
104+
105+
**Bug Bounty**
106+
107+
We operate a discretionary bug bounty program. Rewards are paid in USDC on the chain of your choice.
108+
109+
| Severity | Reward range |
110+
|---|---|
111+
| Critical | $5,000 – $20,000 |
112+
| High | $1,000 – $5,000 |
113+
| Medium | $250 – $1,000 |
114+
| Low | $0 – $250 |
115+
116+
Actual awards within each range depend on the quality of the report, the novelty of the finding, the clarity of the proof of concept, and the impact on users. Reports that include a working exploit and clear remediation advice receive higher awards.
117+
118+
Duplicate reports, out-of-scope issues, and reports that violate this policy are not eligible for rewards. The first reporter of a given vulnerability receives the reward; subsequent reports of the same issue do not.
119+
120+
<Note>
121+
The bounty program is discretionary and does not constitute a binding obligation. We reserve the right to modify reward ranges or discontinue the program with reasonable notice.
122+
</Note>
123+
124+
## What to Include in a Report
125+
126+
A good report helps us fix the problem faster. Please include:
127+
128+
- A clear title and one-line summary.
129+
- The affected component(s) and version or commit hash.
130+
- Steps to reproduce, as minimal as possible.
131+
- A proof of concept — script, transaction, or screenshot — that demonstrates the impact.
132+
- Your assessment of severity and why.
133+
- Any suggested fix or mitigation, if you have one.
134+
- Whether you want public credit, and if so, what name to use.
135+
136+
We will confirm receipt and may ask follow-up questions. Please keep the email thread open until the issue is resolved.
137+
138+
## Acceptance
139+
140+
By submitting a security report to Wraith Protocol, you agree to the terms of this policy.
141+
142+
## See Also
143+
144+
- [TEE Security](/architecture/tee) — key derivation, attestation, and the privacy model
145+
- [Privacy Best Practices](/guides/privacy-best-practices) — how to use Wraith without degrading your own privacy
146+
- [Architecture Overview](/architecture/overview) — system components and trust boundaries

0 commit comments

Comments
 (0)