If you discover a security vulnerability in zkCoins, please report it responsibly:
- Do NOT open a public GitHub issue
- Email: security@zkcoins.app
- Include: description, reproduction steps, impact assessment
- We will acknowledge within 48 hours and provide a fix timeline
This repository is the standalone API process. Vulnerabilities in the live REST surface are reported here (same email). Issues in the trustless node kernel still go to zk-coins/node (see Scope table).
| Component | In Scope |
|---|---|
| REST endpoints | Yes |
| Capability gating / rate limiting | Yes |
| LNURL / alias / push-subscription database (planned; not implemented yet) | Yes |
| Node kernel (see zk-coins/node) | Report there |
| Documentation | No |
Only the latest version on develop is supported with security updates.
We follow a 90-day disclosure policy. After reporting, we will:
- Confirm the vulnerability within 48 hours
- Develop and test a fix
- Release the fix
- Credit the reporter (unless they prefer anonymity)