Bug bounty program

Vendor & launch

The vendor choice (HackerOne) follows design doc §7.10, chosen for its triage workflow maturity, the existing relationships with infrastructure-tier reporters, and its public disclosure pipeline.

In scope

Out of scope

• Validator-owned AWS accounts (per the shared-responsibility model in threat model. These are the validator's responsibility, not the platform's).
• Solana protocol-level issues (out of the platform's blast radius).
• The trader's own wallet, wallet app, or any third-party Solana Pay wallet UI (payment is a single on-chain transaction the trader signs from their wallet; report wallet bugs to the wallet vendor). The marketplace-side logic that builds the transaction and validates the on-chain payment is in scope above.
• Cloudflare / CloudFront / Fastly issues: report to the respective vendor. We re-mediate via the Terraform module if the issue affects our defaults.
• Theoretical Nitro Enclave side-channel attacks already documented as accepted residual risk in PRD §9.9 T8.
• Findings on test, dev, or preview environments (denoted by the staging.swqos.dev or *.vercel.app hostnames). Please report against production targets only.
• Spam-and-phishing-style social engineering of marketplace staff.
• Denial-of-service attacks against the production marketplace, CDN, or any validator's TEE. Exercising the rate-limit code paths in good faith with a coordinated test window is fine, but volumetric attacks are not.

Rewards table

Rewards are paid in USDC on Solana. Amounts are in USD-equivalent at report acknowledgement.

Bounty awards are at the discretion of the security team and can be adjusted based on impact, exploit reliability, report quality, and proof-of-concept clarity. Duplicate reports are awarded only for the first eligible submission.

How to report

1. Encrypt the report with our PGP key (fingerprint published in the website footer once the program launches) and email security@swqos.dev. Or, once the HackerOne program is live, file the report through the HackerOne portal.
2. Include:
   • A clear, reproducible proof-of-concept.
   • The affected target (one of the in-scope items above).
   • Your CVSS 3.1 assessment of severity.
   • Whether the issue has been publicly disclosed elsewhere.
3. Wait. Acknowledgement within 24 h business days. Initial triage within 5 business days. Coordinated disclosure timeline agreed within 14 days of acknowledgement.

Safe harbor

We follow the disclose.io safe-harbor language. As long as the reporter:

• acts in good faith,
• does not access, modify, or destroy data belonging to others,
• does not degrade service availability for legitimate users,
• gives us reasonable time to remediate before public disclosure,

… we will not pursue DMCA, CFAA, or computer-misuse-act claims against the reporter, and we will work with the reporter on coordinated disclosure.

Verifying release artefacts

Every release shipped from releases.swqos.dev/ is built by the GitHub Actions release workflow with SLSA-3 provenance. Reporters investigating supply-chain claims can verify the provenance of any published artefact using slsa-verifier:

# Install the verifier
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest

# Verify a release artefact + its provenance
slsa-verifier verify-artifact \
  --provenance-path <artefact>.intoto.jsonl \
  --source-uri github.com/nodexpert-labs/swqos-marketplace \
  <artefact>

The --source-uri value is pinned to the platform repository. A verification failure on a published artefact is itself a critical finding, so please report it.

References

• Threat model: defines the attack surface.
• PRD §9.9: pre-GA checklist requires a live bug bounty program.
• Design doc §7.10: vendor choice (HackerOne) and rationale.
• .github/workflows/release.yml: SLSA-3 provenance workflow.