RELICS Launchpad

Security & responsible disclosure

RELICS Launchpad welcomes responsible disclosure of security issues. This page is the policy; the machine-readable contact record is at /.well-known/security.txt.

Contact status: not yet verified.This is a pre-launch build. The address below is the project’s final choice, but delivery to it has not been confirmed yet. If you do not receive an acknowledgement, the mailbox — not your report — is most likely at fault. Please do not treat silence as disinterest.

Reporting a vulnerability

Email security@relics.wtf. Please include:

  1. A clear description of the issue and its impact.
  2. Step-by-step reproduction — a proof of concept, transaction traces, or a failing test.
  3. The affected component, chain, and commit or deployed address.
  4. Your assessment of severity and any suggested remediation.

Please do not

  • Open a public issue for a suspected vulnerability.
  • Exploit a finding beyond what is needed to demonstrate it.
  • Access or modify data that is not yours.
  • Run denial-of-service tests against any deployment.

What to expect

  • An acknowledgement within a reasonable window, once the contact mailbox is verified.
  • Updates on remediation progress, and public-disclosure timing coordinated with you.
  • Credit for reporters who want it.

A formal bug-bounty program, its scope, and any rewards are not yet defined. This policy will be updated when they are. Please do not assume a reward is on offer.

Scope

In scope

  • This launchpad web application and its deployment.
  • The launchpad smart-contract source and its on-chain deployments, once broadcast.
  • The SDK, indexer, and governance / upgrade tooling.

Out of scope

  • The separate, pre-existing RELICS artwork site at www.relics.wtf — a distinct property, not part of this launchpad.
  • Third-party dependencies and infrastructure (Uniswap v4, Safe, RPC providers, Vercel, wallets). Report those to their maintainers; a heads-up here is still appreciated.
  • Findings that require a compromised end-user device, physical access, or social engineering of project staff.

Project status

This is a pre-launch build. Contracts are not yet broadcast to any public chain, the web app stays unindexed until it is promoted, and no external security audit has been performed — internal adversarial review only. Please calibrate expectations accordingly: findings here are likely, and welcome.