From 011f3dbfcb86a456bb6b5c96bd5df05031deb28a Mon Sep 17 00:00:00 2001 From: 0dinantes Date: Mon, 3 Aug 2026 19:53:21 +0300 Subject: [PATCH] docs(security): say plainly why our own pre-mainnet reviews are public The policy told outside reporters not to open public issues for anything exploitable, and then the internal review of #15 did exactly that. Read together those two facts look like the team exempting itself. They are not the same case, and the difference is worth stating rather than leaving readers to infer it: the mainnet program ids are not deployed, devnet runs on a collateral token with no value, and #15 itself names the external audit as the gate for turning real money on. There is nothing to steal, so publishing costs nothing and the honest-claims policy applies to our own work first. Also says the part that is easy to get wrong: this is not an invitation for anyone else to post publicly. A reporter does not know what is deployed where, and the rule flips the moment any run holds value. Note the private channel this file points at is currently disabled on both repositories, which is how an outside reporter ended up posting partial exploit details in #15 with nowhere else to put them. Enabling it is a repository setting and is tracked separately; this commit only fixes the policy text. Co-Authored-By: Claude Opus 5 --- SECURITY.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 801f226..f9b3331 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,6 +10,20 @@ Use GitHub's private vulnerability reporting on this repository (Security tab vulnerability"). Reports go to the wienerlabs maintainers privately; do not open a public issue for anything exploitable. +### While the programs hold nothing + +Until mainnet bonds are on, the programs are deployed only to devnet, against a collateral +token with no value, and the mainnet program ids are not deployed at all. There is nothing to +steal, so our own pre-mainnet reviews are published in the open — findings, severities, file +and line, and the tests that reproduce them. The internal review in +wienerlabs/leviathan#15 is the first of these; the report lives in +`leviathan-net/docs/SECURITY_REVIEW_INTERNAL.md`. Publishing them is the honest-claims policy +applied to our own work, and it is deliberate, not an oversight. + +That is a statement about us, not an invitation. If you find something, still use the private +channel: you do not know what is deployed where, and the rule above flips the moment any run +holds value. From then on everything goes private first, including ours. + In scope, in rough order of how much we care: 1. Economic-security breaks: any way to cheat the bond/audit/slash loop with positive expected