This policy applies to every ObolNetwork repository that does not have its own SECURITY.md.

Please do not open a public issue, pull request or discussion for a security problem.

Email security@obol.tech with:

• the affected repository, component and version
• steps to reproduce, or a proof of concept
• the impact you expect

Send reports in plain text, with any proof of concept attached. We aim to reply within 48 hours.

Valid reports in scope can earn a reward. Scope, rules and rewards are in the Obol Bug Bounty Program.

• Our full security process and responsible disclosure standard: obol-security
• Audit reports: docs.obol.org
• security.txt: https://obol.org/.well-known/security.txt