Bug Bounty

not live A bug bounty programme has not been announced live on this page. The outline below is proposed, not an offer, a reward commitment or active safe-harbour terms. Report vulnerabilities privately through Vulnerability Disclosure.

Programme at a Glance

Availability, start date, reward schedule and binding terms require a published launch notice. Questions and private first contact: security@note.systems. No reward amount or payment deadline is confirmed here.

Scope

The proposed scope covers the listed Note Systems contract deployments, including core notes, the oracle, token modules, automation and governance. Verify the network, address and source version on Contract Addresses. A report must identify the precise version tested.

Out of Scope

• Do not test against third-party assets or production infrastructure without authorisation.
• Third-party tokens, feeds, chains and RPC providers have their own disclosure policies.
• A future programme may exclude duplicates, known issues and reports without a security impact.

Severity Matrix

The proposed classification considers direct loss or permanent freezing of funds most seriously, followed by other loss, temporary unavailability and lower-impact defects. Severity and any reward must be assessed under live terms, if a programme is launched.

Launch Phase

Testnet and mainnet reports have different funds-at-risk contexts. No phase-specific reward multiplier or launch timing is promised.

Payment

Any reward requires an active programme, eligibility under its published terms and a confirmed award. No payment in USDG or NOTE, valuation basis or payout deadline is committed by this outline.

Rules of Engagement

1. Report privately using the disclosure channels.
2. Supply a local test or authorised testnet reproduction, not a transaction affecting user funds.
3. Do not use social engineering, phishing or disruptive production testing.
4. Do not publish exploit details before agreeing a coordinated disclosure process.

Safe Harbour

This proposed programme is not an active authorisation to test. Seek written permission where required and do not assume that a future safe-harbour policy covers third-party systems or assets.

Response and Payout SLAs

The disclosure policy lists response targets. Targets are not a reward offer or a confirmed payout schedule.

Governance of the Programme

Governance can approve programme terms and funding. Only terms explicitly published as live apply; there is no report-history table until there is an active programme with reported results.