mirror of
https://github.com/mortdeus/legacy-cc.git
synced 2026-09-25 05:14:50 +00:00
78 lines
2.1 KiB
Markdown
78 lines
2.1 KiB
Markdown
|
# 🔐 Security Policy
|
|||
|
|
|
|||
|
|
## 📆 Supported Versions
|
|||
|
|
|
|||
|
|
| Version | Supported |
|
|||
|
|
|------------------|-----------|
|
|||
|
|
| `main` (latest) | ✅ Yes |
|
|||
|
|
| older versions | ❌ No |
|
|||
|
|
|
|||
|
|
We only support the latest `main` branch for active development and security updates.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 📣 Reporting a Vulnerability
|
|||
|
|
|
|||
|
|
If you discover a security vulnerability, **please report it responsibly**.
|
|||
|
|
**Do not** create a public GitHub issue.
|
|||
|
|
|
|||
|
|
### 🔒 How to Report
|
|||
|
|
|
|||
|
|
Send a private disclosure message to:
|
|||
|
|
|
|||
|
|
- **Telegram (Preferred):** [@mortdeus](https://t.me/mortdeus)
|
|||
|
|
|
|||
|
|
|
|||
|
|
We will acknowledge your report within **48 hours** and work with you on a timely resolution.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 📌 What to Report
|
|||
|
|
|
|||
|
|
Please report vulnerabilities such as:
|
|||
|
|
|
|||
|
|
- Private key leakage
|
|||
|
|
- Transaction spoofing or unauthorized trade execution
|
|||
|
|
- Unsafe default config behavior (e.g. unsafe slippage)
|
|||
|
|
- MEV or sniper logic bugs causing unintended trades
|
|||
|
|
- Telegram command injection / exploits
|
|||
|
|
- Dependency vulnerabilities (e.g. `node_modules` packages with CVEs)
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## ❌ Out of Scope
|
|||
|
|
|
|||
|
|
The following are **not considered security issues**:
|
|||
|
|
|
|||
|
|
- Losing funds due to poor strategy configuration
|
|||
|
|
- Market losses (slippage, impermanent loss, front-running)
|
|||
|
|
- Insecure user environments (e.g. leaked `.env`)
|
|||
|
|
- User misconfiguration or misuse
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🛡️ Security Best Practices for Users
|
|||
|
|
|
|||
|
|
- Always use a **burner wallet** during development and testing
|
|||
|
|
- Never commit your `.env` or `PRIVATE_KEY` to GitHub
|
|||
|
|
- Set proper file permissions for `.env`
|
|||
|
|
- Use strong passwords and 2FA on GitHub and Telegram
|
|||
|
|
- Run the bot on a secure, trusted VPS or local machine
|
|||
|
|
- Review PRs and third-party code before merging
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🤝 Disclosure Process
|
|||
|
|
|
|||
|
|
1. Report vulnerability privately (Telegram or email)
|
|||
|
|
2. We'll confirm receipt within 48 hours
|
|||
|
|
3. We'll investigate and patch within 7–14 days
|
|||
|
|
4. Optional: Public CVE disclosure with your credit
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Thanks for making **Solana Sniper Copy MEV Trading Bot** safer for the entire Solana community.
|
|||
|
|
Security is a shared responsibility — and we appreciate your help.
|
|||
|
|
|
|||
|
|
*Maintained by [@mortdeus](https://github.com/mortdeus)*
|