Security.
If you discover a vulnerability in BurnLedger, please report it responsibly — privately first, so a fix can ship before disclosure. This page is the policy; machine-readable form at /.well-known/security.txt.
Reporting a vulnerability
Email: security@burnledger.io · PGP available on request.
Please do not open a public issue for security vulnerabilities, and do not disclose publicly before a fix has shipped. Include a description of the vulnerability and its impact, steps to reproduce or a proof of concept, and any relevant logs or captures.
Response timeline
| Stage | Commitment |
|---|---|
| Acknowledgment | 2 business days |
| Initial assessment | 5 business days |
| Fix for critical severity | 7 calendar days |
| Fix for high severity | 30 calendar days |
| Fix for medium/low severity | 90 calendar days |
Coordinated disclosure
We follow a 90-day coordinated disclosure window. After releasing a fix we publish an advisory on this page and notify affected customers by email, request a CVE where the vulnerability warrants one, and credit the reporter unless they prefer anonymity.
Scope
In scope: the API server (api.burnledger.io), the dashboard (dashboard.burnledger.io), the browser verifier (burnledger.io/verify/), the TypeScript and Python SDKs, the CLI verification tool, the transparency log protocol, verification record generation and verification, and webhook delivery and signature verification.
Out of scope: denial-of-service against production infrastructure, social engineering, and vulnerabilities in third-party dependencies (report upstream — but tell us too, so we can patch).
Safe harbor
We will not pursue legal action against researchers who act in good faith to avoid privacy violations, data destruction, and service disruption; interact only with accounts they own or have explicit permission for; and report promptly without exploiting beyond proof of concept.
What's underneath
A summary of the security architecture — enclave-held signing keys released only to a measured image, verified-TLS floors on datastore connections, an append-only transparency log — is in the documentation. Claims we cannot yet make (a completed penetration test, SOC 2) are not made.