Skip to main content

Security

Reporting a Vulnerability​

If you discover a security vulnerability, please report it responsibly.

Do NOT open a public GitHub issue.

Report privately via GitHub's security advisory feature: https://github.com/jonah-space/poltrading/security

When reporting, include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment

We aim to acknowledge within 24 hours and provide a remediation timeline within 72 hours.

Scope​

In-scope:

  • PolTrading smart contracts (ConditionalTokens, MarketFactory, ResolutionRouter)
  • Outpost edge proxy
  • Authentication and cryptographic signing

Out-of-scope:

  • Third-party dependencies
  • Social engineering attacks
  • DNS hijacking

Security Measures​

  • Secrets are zeroed in memory on emergency seal (scuttle)
  • mTLS for all internal communication
  • Ed25519 content signatures for feed data
  • HMAC-SHA256 request authentication with replay protection (timestamp window + nonce dedup)
  • Geo-fencing via MaxMind GeoIP2
  • Audit logging (JSON-line request log with TLS fingerprinting)
  • Operator/notary signing keys are testnet-only and injected through local environment variables — never committed, printed, or stored in frontend code