Security

SECURITY.md

Security Policy

Supported versions

Security fixes are prioritized for the latest released protocol and SDK versions.

Reporting a vulnerability

Please report vulnerabilities privately to gc@gustycube.xyz.

Include:

Affected component and version
Reproduction steps or proof of concept
Impact assessment

Do not disclose vulnerabilities publicly until a fix is available.

Response targets

Initial acknowledgment: within 3 business days
Triage and severity decision: within 7 business days
Fix timeline: based on severity and exploitability

For disclosure process details, see docs/SECURITY_DISCLOSURE.md.

There aren’t any published security advisories