Vulnerability Disclosure Policy

We welcome coordinated disclosure from security researchers.

1. Scope

• *.mettaprotocol.app and *.mettaprotocol.io web properties.
• Public smart contracts deployed by the Foundation on BNB Smart Chain.
• Public APIs and backend functions.

2. Out of scope

• Social engineering of staff, users, or vendors.
• Physical attacks.
• Denial-of-service testing, spam, or brute-force.
• Vulnerabilities in third-party services outside our control.

3. Rules of engagement

• Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue.
• Do not disclose publicly before we have had a reasonable opportunity to remediate (target: 90 days).
• Comply with all applicable laws.

4. Safe harbor

Good-faith research consistent with this policy will not be pursued by us as a violation of the Computer Fraud and Abuse Act, DMCA §1201, or our Acceptable Use Policy. If a third party initiates legal action, we will make it known that your activities were authorized.

5. Reporting

Email security@mettaprotocol.app. Include reproduction steps, impact, and any suggested remediation. We acknowledge reports within 3 business days and may offer discretionary bounties for critical, novel findings.