If you find something, tell us in private first. We would rather owe you than read about it.
Where to send it
- Email: support@darkroute.exchange
- GitHub: private security advisory (that repository is the mailbox for every DarkRoute project, including this one)
- X: @DarkrouteRH for a first contact
Machine readable: darkroute.exchange/.well-known/security.txt
What we do
Acknowledge within 3 days, tell you what we found when we reproduce it, fix and deploy, and credit you publicly if you want that. Scope, the severity ladder and the rules are at darkroute.exchange/security.
What we pay
Rewards are sized to impact and to what a router with almost no revenue can afford. Every paid report is published in full, with the amount and the transaction that paid it, at darkroute.exchange/security/reports, including the parts that stayed open.
Please
Report privately, do not touch other people's data to prove a point, and give us ninety days from acknowledgement or until the fix ships, whichever comes first.