Skip to content

Security: DEXignation/dexignation-api

Security

SECURITY.md

Security Policy — dexignation-api / 보안 정책

Reporting / 제보

Do not open public GitHub issues for security vulnerabilities. Email us privately:

보안 취약점은 공개 GitHub 이슈로 올리지 마세요. 비공개로 이메일 주세요:

We aim to acknowledge within 48 hours and to triage within 5 business days.

48시간 내 수신 확인, 5영업일 내 1차 분석.


Trust boundaries / 신뢰 경계

This service is read-only. It:

  • Holds no private keys.
  • Signs no transactions.
  • Stores no user secrets (no passwords, no API keys belonging to end users).
  • Talks to the chain via an RPC URL and to a local database — that's it.

본 서비스는 읽기 전용입니다. 키 보관·트랜잭션 서명·사용자 시크릿 저장 없음. 체인 RPC와 로컬 DB에만 접근합니다.

If a finding requires that we hold user funds or keys, please double-check the report — by design we never do either.

기여물이 사용자 자금이나 키를 보유해야 성립한다면 리포트를 다시 확인해 주세요. 설계상 그런 일은 일어나지 않습니다.


In scope / 범위 내

  • HTTP route logic and input validation
  • Rate-limit bypass
  • Authorisation / authentication weaknesses on admin endpoints (if any)
  • SSRF, SQL injection, path traversal, prototype pollution
  • Indexer logic that could corrupt or skip data
  • Dependency vulnerabilities affecting reachable code paths

Out of scope / 범위 외

  • Issues that require physical access or social engineering
  • Theoretical findings without a feasible exploit path
  • Third-party RPC provider outages
  • Database tuning or capacity issues
  • Reports about the smart contracts themselves — those belong in dexignation-contracts

스마트 컨트랙트 관련 제보는 dexignation-contracts 저장소로.


Disclosure / 공개

We follow coordinated disclosure. After agreeing on a fix and a public date, we publish a post-mortem with credit to the reporter (anonymous on request).

조율된 공개. 수정과 공개일 합의 후 포스트모템을 공개하고 제보자에게 공로 표기(익명 요청 시 익명).

There aren't any published security advisories