Rules and Requirements

We require that all researchers:

• When investigating a vulnerability, please, only ever target your own accounts. Never attempt to access anyone else’s data and do not engage in any activity that would be disruptive or damaging to your fellow users;
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing;
• Perform research only within the scope set out below;
• Use the identified communication channels to report vulnerability information to us;
• Keep information about any vulnerabilities you’ve discovered confidential between yourself and FIO until we’ve had 90 days to resolve the issue;
• Only perform security research against a local node. Instructions for setting up a local node are available on the Building a node page; and
• If you want to perform research against the FIO Testnet, please engage with the FIO Testnet Telegram group and ask for guidance.

If you follow these guidelines when reporting an issue to us, we commit to:

• Not pursue or support any legal action related to your research;
• Work with you to understand and resolve the issue quickly (including an initial confirmation of your report within a reasonable amount of time); and
• Recognize your contribution (if requested), if you are the first to report the issue and we make a code or configuration change based on the issue.