git.iko.soy/urbit.org
on master help sign in
Update and rename bounty.md to bounties.md
d0f5aedMorgan Sutherland
content/bounties.mdnew file+7
compare with master
unifiedsplit
@@ -0,0 +1,7 @@
1++++
2+title = "Bug Bounties"
3++++
4+
5+We're running a security bug bounty program with [HackerOne](https://hackerone.com). See the [Tlon Corp](https://hackerone.com/tlon/) page for more information. If you've found a vulnerablity, and you'd like to claim a bounty, please submit a report there. Note that our bounty program is currently focused on [Azimuth](https://github.com/urbit/azimuth) vulnerabilities.
6+
7+For general inquiries and disclosures, please contact our security team at [security@tlon.io](mailto:security@tlon.io).
content/bounty.mddeleted−11
@@ -1,11 +0,0 @@
1−+++
2−title = "Bug Bounties"
3−+++
4−
5−We are in the process of designing our Bug Bounty Program. In the meantime, if you believe you have discovered a bug or vulnerability in our code, please report it to [security@tlon.io](mailto:security@tlon.io).
6−
7−We'll review the issue, and a member of our dev team will get back to you ASAP. If your bug has merit, we'll work with you to fix it, and award a bounty based on the severity of the bug. We determine severity using the [CVSS](https://www.first.org/cvss/calculator/3.0) model.
8−
9−Once the fix is complete, we'll publish a full retrospective in the interests of transparency. If the bug leaks prior to the retrospective being published, the bounty is void.
10−
11−We look forward to working with you.