Security policy

Reporting a vulnerability

Please do not open a public issue for anything that could affect consensus, funds or node availability. Email security@argonmine.com with:

• what the bug is and which component (consensus, chain, p2p, mempool, wallet, rpc, pool, apps);
• how to reproduce it (a failing test, a block or transaction hex, or steps);
• your assessment of impact.

You will get an acknowledgement within 48 hours and a fix timeline within 7 days. We credit reporters in the release notes unless they prefer otherwise. A bounty programme will be announced before mainnet; until then, rewards are at our discretion.

Scope

In scope: anything in this repository that can create coins, steal or freeze coins, split the chain, crash or stall nodes remotely, or leak wallet secrets.

Out of scope: denial of service that requires more hashrate than the honest network, issues in third-party dependencies already disclosed upstream, social engineering.

Supported versions

Only the latest release. Consensus changes are scheduled hard forks announced in advance; nodes on old versions will stop following the chain at the activation height.

Disclosure

We coordinate disclosure: fix first, then publish the advisory with the reporter's credit. For consensus bugs that require a network-wide upgrade we may delay details until most nodes have updated.