Security
Here you'll find how we handle security reviews, where our audit reports live, and how our bug bounty works. For reporting steps, safe harbor, and legal terms, read our Security Policy.
Security audits
We work with external auditors on major releases and components, and we run internal security reviews as we ship. The full list of external and internal reports — with PDFs — lives in one place.
→Browse all audit reports on Espresso Systems' GitHubA few recent examples — the repo has the full list, dates, and download links:
Bug bounty
We run a bug bounty to reward responsible disclosure of security issues in our smart contracts and other in-scope code. If you find something, please report it using the process in our Security Policy. Eligible reports can qualify for a reward.
Scope
Smart contracts
Relevant Rust components (if applicable)
Severity and rewards
Reward tiers are a guide. Actual rewards depend on impact, how easy the issue is to exploit, and how clear your report is. Espresso Foundation decides final amounts.
Submission requirements
To be eligible for a reward, include the following. Incomplete reports may not qualify.
How to report
Use our Security Policy for where and how to send a report. We try to acknowledge new reports within a few business days.
Read the Security Policy↗Responsible disclosure
When you submit a report, please follow our Security Policy. In short:
Review process
Our security team triages reports, checks impact, assigns severity based on risk, and works with engineering on fixes. Timing depends on how complex the fix is. Triage, safe harbor, and payouts are all covered in the Security Policy.
Rewards and payment
Additional notes
Security policy and resources
If you're building on top of Espresso, treat vulnerabilities as confidential until disclosure is coordinated, and use the same reporting path as everyone else.