Security
Found a vulnerability? Tell us privately and we will work with you to fix it.
How to report
Email operatoruplift@gmail.com with Security in the subject. Please do not open a public issue or share details until a fix has shipped.
Include what is affected, the steps to reproduce it and what an attacker could gain. For the escrow program, name the instruction and accounts, and the artifact hash if you built one. For the website or API, include the X-Request-Id header from the response.
Rules for testing
- Use your own accounts and test data. If you reach someone else's data, stop, and do not keep, change or delete it.
- The escrow program runs on Solana devnet. Never send real funds to a program address.
- No denial of service, load tests, spam or social engineering.
In scope
operatoruplift.com and the app at /app, the API behind them, the Seeker app and the uplift-escrow Solana program.
These details are also published for tools at /.well-known/security.txt.