security // disclosure_policy
Found something? Tell us privately first. This page covers how to report, what is in scope, and the protections that are (and are not) in place.
report
scope
solana program
website
blindbounty.xyz
The web app and its transaction-building flows.
api
blindbounty.xyz/api
Public read endpoints, uploads and transaction builders.
security_model
> vault.exits
The program has no instruction that sends a Bounty Vault to the team. A vault can only pay Diamond Hands and the 20% dev share after a successful quest, or buy back and burn the token.
> vault.unclaimed
Anything not claimed before the claim deadline is bought back and burned. It never returns to the team.
> verdict
Outcomes are proposed by the keeper from public on-chain data, with evidence files published for every proposal, followed by a challenge window in which the platform guardian can veto a wrong proposal before anything is final.
> program.upgrade
Plainly: the on-chain program is upgradeable by the team's upgrade authority. Treat that as part of the trust model when deciding what to put at risk.
good_faith
Good-faith security research is welcome. If you act in good faith, stay within this policy and give us a reasonable chance to fix an issue before talking about it, we won't treat your research as hostile. For how the protocol works end to end, see How it works.