Security is the foundational pillar of the OgaRent protocol. Because our system acts as an escrow for large yearly rent deposits, we prioritize the safety of user funds above all else, including feature velocity and rapid shipping.

This document outlines our security philosophy and provides instructions for responsible vulnerability disclosure.

In the OgaRent ecosystem, user funds take absolute priority. We operate under the assumption that our smart contracts and backend services are high-value targets. As such, all code that touches or dictates the movement of escrowed funds must undergo rigorous review and testing before merging. We prefer to ship slower if it means shipping securely.

If you discover a security vulnerability in any of our repositories (ogarent, ogarent-contracts, or ogarent-app), we ask that you practice responsible disclosure.

• Never disclose smart contract exploits publicly.
• Do not open GitHub issues for vulnerabilities.

Instead, please privately report your findings by emailing us directly at:

security@ogarent.network

When submitting a vulnerability report via email, please include as much detail as possible to help us triage and verify the issue efficiently.

A strong report should include:

• Affected Components: Clearly state which repository and file(s) are vulnerable.
• Reproduction Steps: Provide a clear, step-by-step guide on how to reproduce the vulnerability.
• Impact Assessment: Explain what an attacker could achieve (e.g., draining the escrow vault, freezing funds, bypassing authentication).
• Proof of Concept: Where appropriate, include code, scripts, or transaction payloads that demonstrate the exploit.

We take all security reports seriously. When you submit a vulnerability, our maintainers will adhere to the following process:

1. Acknowledge: We will acknowledge receipt of your report within 48 hours.
2. Investigate: Our core team will reproduce and verify the vulnerability.
3. Coordinate Fixes: We will develop and rigorously test a patch in a private fork.
4. Remediate: We will deploy the fix to the affected environment.
5. Disclose Responsibly: After the vulnerability is patched and user funds are secured, we will publish a post-mortem acknowledging your contribution.

We greatly appreciate security researchers who help keep OgaRent safe.

While OgaRent does not currently operate a traditional paid bug bounty program, critical security fixes and responsible disclosures may receive discretionary Drips governance points as a token of our appreciation. Please note that these rewards are entirely discretionary, and we do not promise guaranteed payouts for bug reports.

Security is a collaborative effort. We encourage all developers, auditors, and community members to adopt a security-first mindset when interacting with the OgaRent codebase. By working together and disclosing vulnerabilities responsibly, we can build a robust, trustless platform that protects Nigerian renters and landlords alike.