We ask security researchers to keep vulnerabilities and communications around vulnerability submissions private and confidential until a patch is developed to protect the people using Cronos.org’s protocols. In addition to this, we ask that you:
- Allow us a reasonable amount of time to correct or address security vulnerabilities.
- Avoid exploiting any vulnerabilities that you discover.
- Demonstrate good faith by not disrupting or degrading Cronos.org’s data or services.
Once we receive a vulnerability report, Cronos.org will take these steps to address it:
- Cronos.org will confirm receipt of the vulnerability report within 5 business days. The timing of our response may depend on when a report is submitted. As our daily operations are distributed in time zones across the globe, response times may vary. If you have not received a response to a vulnerability report from us within 5 business days, we encourage you to follow up with us again for a response.
- Cronos.org will investigate and validate the security issue submitted to us as quickly as we can, usually within 10 business days of receipt. Submitting a thorough report with clear steps to recreate the vulnerability and/or a proof-of-concept will move the process along in a timely manner.
- Cronos.org will acknowledge the bug, and make the necessary code changes to patch it. Some issues may require more time than others to patch, but we will strive to patch each vulnerability as quickly as our resources and development process allow.
- Cronos.org will publicly release the security patch for the vulnerability, and acknowledge the security fix in the release notes once the issue has been resolved. Public release notes can reference to the person or people who reported the vulnerability, unless they wish to stay anonymous.
If you discover a security vulnerability, you can report it through the Cronos Bug Bounty Program.