Vulnerability Disclosure Policy

Introduction

This Vulnerability Disclosure Policy outlines the process through which individuals can report vulnerabilities found within our systems, networks, or services. We recognize the value of the security community's efforts in helping us secure our services and are committed to addressing all reported vulnerabilities in a timely manner.

Bug Bounty Programs

For smart contracts vulnerabilities, Kiln operates dedicated programs with their own reward structure:

The rest of this policy focuses on the scope detailed further down.

Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Kiln will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.

Guidelines

Under this policy, "research" means activities in which you:

Notify us as soon as possible after you discover a real or potential security issue.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
Do not submit a high volume of low-quality reports.

Once you've established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

Test methods

The following testing and reporting activities are strictly prohibited:

Destructive Testing: Any form of testing that disrupts, damages, or degrades the usability of our systems, services, or data.
Unauthorized Access to Data: Accessing, downloading, modifying, or deleting data from Kiln systems or services that the researcher does not own.
Social Engineering: Any form of testing involving deception or manipulation of our employees, contractors, or users.
Denial of Service: Executing any form of attack that degrades, disables, or interrupts service availability.

Scope

Smart contract scope and testing guidelines are managed directly on Cantina, where each program defines its own in-scope contracts, exclusions and rules:

Rewards

Reward amounts for smart contract vulnerabilities are set and paid out per program on Cantina, based on severity and impact:

Reporting a vulnerability

We only accept vulnerability reports through Cantina. Please submit your findings directly on the relevant program page:

Reports sent to security@kiln.fi will no longer be monitored or accepted.

What we would like to see from you

In order to help us triage and prioritize submissions, we require that your reports:

Include a full proof-of-concept.
Describe the location the vulnerability was discovered and the potential impact of exploitation.
Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts, screenshots and videos are helpful).
Not be shared publicly without obtaining permission from us first, and never without suitably redacting sensitive information, including but not limited to IP addresses, full paths to endpoints, and PII (personal identifiable information).
Don’t hesitate to add details about your security credentials and track record.
Be in English, if possible.

What you can expect from us

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.

Within 5 business days, we will acknowledge that your report has been received.
To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.
We will maintain an open dialogue to discuss issues.

Policy Updates

This policy is subject to periodic review and may be updated or modified at any time by Kiln without prior notice.

Questions

Questions regarding this policy may be sent to security@kiln.fi. We also invite you to contact us with suggestions for improving this policy.