Hash Chain is pre-launch. There is no deployed code in this repository, only proposal text. Security review of a proposal is still valuable: a flaw found in a draft costs far less than a flaw found later.

• A weakness in a proposed design that could break privacy, for example a way to link an entry to an exit.
• A weakness that could lead to loss or theft of funds, for example in a swap, connection or liquidity network proposal.
• A mistake in a cryptographic assumption or data structure.
• Any statement in a HIP that could mislead users about their risk.

Please report privately. Open a private security advisory on this repository using the "Report a vulnerability" option under the Security tab. Do not open a public issue or pull request for a vulnerability, and do not post details on social media before we have had a chance to respond.

Include, as far as you can:

• A description of the problem and the affected HIP and section.
• The impact you expect.
• Steps or reasoning that reproduce or demonstrate it.
• Any suggested fix.

• We will acknowledge the report in the advisory thread.
• We will work with you to understand and confirm the issue.
• We will update the HIP and credit you if you wish, once a fix is agreed.

Good-faith research and responsible disclosure under this policy will not be met with legal action. Please avoid accessing other people's data or disrupting any live service.

There is no bounty program at this stage. Any future program will be announced on the official channels linked from the README.