Do not open a public GitHub issue or pull request for security problems.

Use GitHub’s private vulnerability reporting:

1. Go to https://github.com/ZecHub/zec-bounties/security/policy
2. Click Report a vulnerability
3. Fill in the details (description, impact, affected code, suggested fix if you have one)

You can also open a private conversation with the maintainers on the ZecHub Discord and mention @dismad if you prefer.

We will acknowledge receipt and coordinate next steps. Do not disclose the issue publicly until we have agreed on a timeline.

This policy covers:

• zec-bounties (this repository)
• The production site at https://bounties.zechub.wiki
• Wallet handling, payout logic, authentication, and authorization in the backend

It does not cover:

• Upstream Zcash protocol, Zebra, Zaino, or Zingo issues (report those to their own projects)
• Third-party services (Vercel, GitHub, Discord, etc.)

• Public issues that describe exploitable problems
• Reports that only affect local development setups with no production impact
• Social engineering or physical attacks

Thank you for helping keep ZEC Bounties and its users safe.