Security & Responsible Disclosure

Report a vulnerability

Email security@omne.foundation with the details of the finding. Encrypt the report using our PGP key if the vulnerability is critical.

Scope

The following surfaces are in scope for responsible disclosure:

• Ignis devnet RPC — rpc.ignis.omnechain.network
• Omne node software — the omne-node and omne-validator binaries and their dependencies
• SDK — @omne/sdk on npm
• Phaylos wallet — consumer wallet published at phaylos.xyz
• This site — omne.foundation, docs.omne.foundation

Out of scope

• Reports relying on volumetric denial-of-service (rate-limiting is intentional on devnet)
• Findings on third-party dependencies without exploit paths specific to Omne
• Self-XSS and issues requiring social-engineering of the reporter
• Missing HTTP security headers without a demonstrable exploit path
• Issues already disclosed publicly or already known to the team

What we commit to

• Acknowledge receipt within 72 hours
• Keep you informed of remediation progress
• Credit you in release notes (if desired) once the issue is resolved
• Not pursue legal action against researchers acting in good faith within the scope above

Bug bounty program

Omne runs a phased bug bounty program. Ignis devnetfindings are eligible for recognition and, at the Foundation's discretion, for inaugural-program rewards once the Testum testnet brings on-chain treasury disbursement. The formal monetary program activates with the Testum testnet launch and expands at Primum mainnet.

Severity tiers

Reward amounts will be published in OMC and/or OGT at the Foundation's discretion once the Testum testnet treasury-disbursement surface is live. The Foundation reserves the right to adjust severity classification based on demonstrated exploit impact.

Disclosure timeline

• T + 0: you report to security@omne.foundation
• T + 72h: we acknowledge receipt and assign a tracking ID
• T + 7 days: triage complete with preliminary severity rating
• T + 30–90 days: remediation shipped to devnet, then Testum, then Primum as each network comes online
• T + 30 days post-fix:coordinated disclosure (advisory published, researcher credited if desired). Critical findings may be held for 90 days at the Foundation's discretion to allow validators to upgrade.

Hall of fame

Researchers credited for accepted findings are listed at omne.foundation/security#hall-of-fame (page populated once inaugural findings close). Credit is opt-in; researchers preferring anonymity are never named.

Rules of engagement

• Test against the public Ignis devnet only. Do not attack mainnet-designated RPC endpoints (even if reachable pre-launch).
• Do not degrade service for other testnet users. Bounded proofs-of-concept against your own accounts only.
• Do not access, modify, or exfiltrate data that is not yours. On-chain data is public; off-chain Foundation systems are not in scope.
• Do not publicly disclose a finding before the timeline above completes or 90 days elapse, whichever is first.
• One researcher per finding — duplicate reports are credited by timestamp. Collaborating researchers share credit and reward.
• Automated scanning: rate-limited only; do not trigger volumetric DoS.

Safe harbor

Testing must not intentionally harm users, the network, or its validators. Do not access accounts or data that are not yours. Do not publish a vulnerability before it is resolved or 90 days pass since report, whichever comes first. Good-faith research within these bounds is welcome.