Prepare repo for public bug bounty launch

CLAUDE.md

@@ -1,7 +1,7 @@
 Read the README.md for a description of the folder contents.
 
-For the project https://github.com/HorizenLabs/staker  you must:
-- base the work on the branch: pc/devnet 
+For the project https://github.com/HorizenOfficial/staker you must:
+- base the work on the branch: dev (merges to main at the v1 mainnet go-live)
 - see the file docs/frontend-integration.md for an explanation of the features that must be provided by the UX
 
 # General hints
@@ -43,7 +43,7 @@ case.
 
 # Dev environment
 
-To run the sysyem locally, the `staker/devnet/` docker-compose stack (anvil chain `31337` + graph-node +
+To run the system locally, the `staker/devnet/` docker-compose stack (anvil chain `31337` + graph-node +
 auto-deployed contracts & subgraph) can be used. Restarting anvil yields a fresh chain with
 deterministic addresses that stay the same across clean restarts. Deployed
 addresses live in `staker/broadcast/DeployZenStakerTestnet.s.sol/31337/run-latest.json`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Horizen Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,7 +1,7 @@
 # Horizen Staking Services
 
 This repo contains services to support the official Horizen Staking program.
-Based on the official staker contracts: https://github.com/HorizenLabs/staker 
+Based on the official staker contracts: https://github.com/HorizenOfficial/staker
 
 
 ## Repository content
@@ -13,11 +13,11 @@ Based on the official staker contracts: https://github.com/HorizenLabs/staker
     Users are identified via MetaMask connection<br/>
 
     The frontend reads indexed/historical data from the ZenStaker subgraph
-    (see `https://github.com/HorizenLabs/staker/subgraphs/`) and live data (unclaimed rewards, global state)
+    (see https://github.com/HorizenOfficial/staker/tree/dev/subgraphs) and live data (unclaimed rewards, global state)
     plus all write transactions directly from the chain via ethers v6.
     No custom backend service is used.
 
-See [claude.md](claude.md) for further info.
+See [CLAUDE.md](CLAUDE.md) for further info.
 
 ## Local development
 
@@ -57,7 +57,7 @@ previews. The "testnet environment" banner shows automatically whenever
 |---|---|---|
 | `RPC` | JSON-RPC endpoint — **public HTTPS, CORS-enabled** | `https://rpc.example.com` |
 | `CHAIN_ID` | Target chain id (`26514` = ZEN mainnet) | `26514` |
-| `CONTRACT_STAKER` | Staker contract address (ERC1967 proxy) | `0x…` |
+| `CONTRACT_STAKER` | Staker contract address | `0x…` |
 | `CONTRACT_TOKEN` | ZEN token (ERC-20) address | `0x…` |
 | `SUBGRAPH` | Public subgraph GraphQL endpoint | `https://…/subgraphs/name/zen-staker` |
 | `EXPLORER_URL` | Block-explorer base URL (for tx/address links) | `https://explorer.example.com` |
@@ -76,4 +76,13 @@ Cloudflare deploys one **production branch** (the dApp's main domain +
 URL. The production branch is configurable any time under
 *Settings → Builds → Branch control*.
 
+## Security
+
+Please do not report security vulnerabilities through public GitHub issues —
+see [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE)
+
 

SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.**
+
+A bug bounty program covering the Horizen staking system runs on
+[Immunefi](https://immunefi.com/).
+
+<!-- TODO: replace with the public Immunefi program link once published -->
+
+For reports outside the bounty scope — or before the program page is live —
+use GitHub's private vulnerability reporting on this repository
+(*Security → Report a vulnerability*).
+
+## Scope
+
+| Period | Scope |
+|---|---|
+| Jul 15 – Jul 27, 2026 | **Testnet** deployment (Horizen Testnet, chain ID 2651420) |
+| From Jul 27, 2026 | Extended to the **mainnet** deployment (Horizen, chain ID 26514) |
+
+- **Staking dApp** — this repository (`frontend/`), deployed at
+  https://staking-testnet.horizen.io
+- **Staking contracts & subgraph** — https://github.com/HorizenOfficial/staker
+- **In-scope testnet contract addresses** — see
+  [`frontend/.env.testnet`](frontend/.env.testnet)
+
+The authoritative scope, impacts, rewards, and rules of engagement are defined
+on the Immunefi program page; where this file and the program page differ, the
+program page wins.
+
+## Rules of engagement
+
+- **Proof-of-concept execution is local-only.** Run PoCs against a local node
+  or a local fork of testnet/mainnet state (e.g. Anvil/Foundry/Hardhat).
+  Broadcasting exploit transactions to **any public network — testnet
+  included — is prohibited**: a public transaction is public disclosure of the
+  exploit and can be replayed by anyone. Reading public state and forking it
+  locally is fine.
+- For frontend findings, run the dApp locally against a local chain (see
+  [README — Local development](README.md#local-development)) or limit the
+  demonstration to client-side behavior with no on-chain writes.
+
+## Notes on this repository's attack surface
+
+- The dApp is a **fully client-side static export** — no backend, server, or
+  edge runtime. Server-side web vulnerabilities (SSRF, middleware bypass,
+  React Server Component or image-optimization issues) do not apply to the
+  deployed site.
+- Subgraph staleness or unavailability is surfaced to users by a health banner
+  by design, and write paths never depend on the subgraph — data staleness
+  alone is not a vulnerability.
+- Third-party infrastructure (Base, Caldera rollup infra, LayerZero, Goldsky,
+  Cloudflare Pages, CoinGecko) is out of scope for this repository.

frontend/.env.template

@@ -17,8 +17,7 @@ BRIDGE_ZEN_URL=
 # CoinGecko coin id used to price the staked token in USD for the "Staked
 # value" stat ("zencash" is correct for ZEN — CoinGecko kept the pre-rebrand
 # slug, "horizen" does not exist as an id there). Leave blank to disable
-# (e.g. on a 
-deploying a mock token, not real ZEN).
+# (e.g. on a devnet deploying a mock token, not real ZEN).
 COINGECKO_ID=zencash
 # Subgraph health check (useSubgraphHealth): block gap above which the
 # subgraph is considered behind the chain head, how many consecutive polls it
@@ -28,4 +27,4 @@ COINGECKO_ID=zencash
 # behindThresholdAttemptInterval seconds (~2 min by default) before warning.
 BEHIND_THRESHOLD=30
 BEHIND_THRESHOLD_ATTEMPT=4
-BEHIND_THRESHOLD_ATTEMPT_INTERVAL=30
+BEHIND_THRESHOLD_ATTEMPT_INTERVAL=30

frontend/components/HowItWorks.tsx

@@ -4,7 +4,7 @@ import { CONFIG } from "@/lib/config";
 import { addressUrl, tokenUrl, truncateAddress } from "@/lib/format";
 import { useTokenSymbol } from "@/lib/tokenSymbol";
 
-const CONTRACTS_SOURCE_URL = "https://github.com/HorizenLabs/staker";
+const CONTRACTS_SOURCE_URL = "https://github.com/HorizenOfficial/staker";
 
 function SectionLabel({ children }: { children: React.ReactNode }) {
   return (

frontend/package.json

@@ -2,6 +2,7 @@
   "name": "zenstaker-frontend",
   "version": "0.1.0",
   "private": true,
+  "license": "MIT",
   "engines": {
     "node": "24.16.0"
   },