| Version | Supported |
|---|---|
| latest | ✅ |
| 1.x | ✅ |
| 0.x | ❌ |
The security of Phoenix Protocol is maintained and monitored by The Coastal Assassins. We take all security vulnerabilities seriously.
If you discover a security vulnerability within Phoenix Protocol, please do not disclose it publicly until a patch has been released.
- Do not disclose publicly: Do not create public GitHub issues, discussions, or pull requests detailing the vulnerability.
- Contact the Owning Team: Reach out directly to The Coastal Assassins security team or submit a private advisory through GitHub's Security Advisories tab.
- Alternatively, if an email is provided in the future, report it there.
- Information to Include:
- Description of the vulnerability and potential impact.
- Steps to reproduce or proof-of-concept configuration / payload.
- Any affected components (e.g. backend normalization engine, rule evaluator, frontend).
The Coastal Assassins commit to:
- Acknowledging receipt of security reports within 48 hours.
- Providing a preliminary assessment and remediation timeline within 5 business days.
- Coordinating public disclosure once an appropriate patch has been released.
At this time, The Coastal Assassins do not offer a paid bug bounty program, but we offer public acknowledgement and gratitude in our release notes and Hall of Fame for responsible disclosures.