Skip to main content
The bug bounty and vulnerability reporting program is no longer active. New submissions will not be handled. The material below is a historical record of scope, safe harbor, and the PGP key used while the program ran. Read Announcement.

​
Scope

These were the in-scope and out-of-scope surfaces while the program was active. In scope
  • The Megapot smart contracts listed in Protocol Reference
  • megapot.io, docs.megapot.io, api.megapot.io, and llms.megapot.io
  • Services operated by Megapot Inc. that handle ticket purchases, drawings, payouts, and partner integrations
Out of scope
  • Third-party apps and integrations not operated by Megapot Inc., even when they build on the protocol — see the community builders list for examples
  • Social engineering of staff, players, or partners
  • Denial-of-service testing against production systems
  • Issues that require physical access to a target device, or that depend on already-compromised end-user hardware
  • Reports generated solely by automated scanners with no demonstrated impact

​
Safe harbor

While the program was active, we would not pursue legal action against researchers who:
  • Acted in good faith and followed this policy
  • Avoided privacy violations, data destruction, and any disruption that affects other users
  • Stopped at the minimum proof needed to demonstrate the issue
  • Gave us a reasonable window to remediate before any public disclosure

​
PGP key

The Megapot Security Team key used while the program was active. It is published here as a historical record, not as an intake channel.
  • Fingerprint: 2EF5 AADA 56CE 7BAF 7B8D 7712 0F54 74FE C123 F502
  • Key ID: 0xC123F502
  • Type: RSA 4096, expires 2030-05-19
For previously published audit work, see the Audits page.