DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please report them privately:

1. Email: security@[your-domain-here]
2. Subject: "Security Vulnerability in Platform DAO"
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if you have one)

• Initial response: Within 48 hours
• Assessment: Within 7 days
• Fix timeline: Depends on severity
  • Critical: 1-3 days
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Next release cycle

We follow coordinated disclosure:

1. You report the vulnerability privately
2. We confirm and assess the issue
3. We develop and test a fix
4. We deploy the fix to testnet
5. We notify affected users (if applicable)
6. We deploy to mainnet after governance vote (if required)
7. We publicly disclose 30 days after fix is live
8. We credit you in the disclosure (unless you prefer anonymity)

Coming soon: We plan to launch a bug bounty program after mainnet launch.

Severity levels:

• Critical: $5,000 - $25,000 (funds at risk, governance takeover)
• High: $1,000 - $5,000 (core feature broken, data leak)
• Medium: $500 - $1,000 (limited impact)
• Low: $100 - $500 (edge case, minimal impact)

Bounty amounts will be voted on by token holders.

In scope:

• Smart contracts (PlatformToken, Governor, Timelock, HandoverVault)
• Mobile app authentication and wallet integration
• API endpoints handling sensitive data
• Governance vote manipulation
• Treasury access vulnerabilities

Out of scope:

• Social engineering
• Third-party dependencies (report to upstream)
• Issues already publicly disclosed
• Spam, DoS, or DDoS attacks

For Contributors:

• Never commit private keys or mnemonics
• Use .env files (gitignored) for secrets
• Run Slither on all contract changes
• Test governance edge cases (quorum manipulation, vote buying, etc.)

For Users:

• Never share your seed phrase
• Verify contract addresses before interacting
• Use hardware wallets for large holdings
• Enable 2FA on GitHub and all accounts

Pre-audit status: These contracts are NOT yet audited. DO NOT use on mainnet until audited.

None at this time.

Thank you for helping keep Platform DAO secure!

We value the security community and responsible disclosure.