# Security policy

> Report a vulnerability privately, understand research rules, and follow the response and disclosure timeline.

Source: https://docs.iceroot.com/security/

Report vulnerabilities through [GitHub private vulnerability reporting](https://github.com/iceroot-network/.github/security/advisories/new). This form accepts reports about any IceRoot repository, including Heartwood Core. Do not put vulnerability details in a public issue, pull request, or validator contribution entry.

## What to include

Name the affected repository and version or commit, describe the impact, and include a working reproduction on your own local network or private devnet. A test, script, or precise sequence of steps should let maintainers reproduce the problem. Include only the data needed to demonstrate it.

A private report first is a condition for any security reward. If you are unsure whether a bug has a security effect, use the private form. Maintainers review its impact and eligibility under the [bounty program](https://docs.iceroot.com/programs/bounties/index.md).

## Research rules

- Test on your own local copies or a private devnet. Do not attack mainnet, public websites, or nodes you do not run.
- The relaunched public testnet, once it runs, is the exception for its validators: it is meant to be attacked and broken, and they are encouraged to crash nodes and look for attack vectors there. Report what you find privately under this policy.
- Do not access, change, or take anyone else’s data, keys, or funds.
- Do not use social engineering or physical attacks, and do not use denial of service against shared services other than that testnet.
- Stop once you have a reproduction and report it privately. Keep details private until the advisory is published.

Good-faith research that follows these rules is authorized. The IceRoot team will not pursue legal action against researchers for that work. This safe harbor covers research within these rules.

## Response and publication

| Step             | Commitment                                                                                                                                                |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Acknowledgment   | Within 3 working days of the report                                                                                                                       |
| Severity rating  | Within 14 days of the report                                                                                                                              |
| Progress updates | At least every 14 days until resolved                                                                                                                     |
| Publication      | A GitHub security advisory for every fixed report, once its fix is live, no later than 90 days after the report, subject to the consensus exception below |

The fix targets are 30 days for Critical and High reports and 90 days for Medium and Low reports. These are targets, not guaranteed fix dates.

A consensus vulnerability is disclosed only after the fix has passed its activation height. If activation cannot be reached within 90 days, the team may use one extension of up to 30 days and must state the reason publicly. The publication deadline with that extension is 120 days after the report.

Until activation, a consensus fix is announced as a security release with its activation height, without vulnerability details. Once the advisory is published, the reporter may publish their own account of the finding. Credit is optional: choose attribution by GitHub name or remain anonymous.

Security rewards enter the public [program list](https://docs.iceroot.com/programs/index.md) and are paid after the advisory is published, so a public payment does not disclose an unfixed vulnerability. Live-network incident announcements remain case by case; these response and publication promises apply to privately reported vulnerabilities.

[Bounty program →](https://docs.iceroot.com/programs/bounties/index.md) · [Program list →](https://docs.iceroot.com/programs/index.md)