How to Publish a Security Disclosure Policy a Whitehat Will Actually Use

Why disclosure channels fail

The best-documented whitehat rescue in DeFi did not start with a security disclosure policy. When samczsun found a bug exposing about 25,000 ETH in Lien Finance in September 2020, he reached the team by pinging a contact at ConsenSys Diligence and then the ETHSecurity Telegram channel, because no direct channel existed. The fix itself had to travel through a private transaction relay so that nobody could front-run it. Six years later, most of the largest protocols still publish no machine-readable route for a report.

We measured it on September 2, 2026. For each of the 30 largest protocols by total value locked on DefiLlama, we requested /.well-known/security.txt from the website DefiLlama lists for the protocol. All 30 sites responded. Three served a file: Lido, JustLend and Binance. Only JustLend's file carried the Expires field that RFC 9116 makes mandatory. Curve, outside the top 30, served a file whose Expires date had passed on August 1, 2026, so a strict parser treats it as stale. Of the 23 DeFi Security Alliance member firms, three websites did not respond, and one of the remaining 20 publishes the file.

The wider internet looks similar. An IoT Defense scan of 241 million domains in early 2026 found the file on 0.238 percent of them, and 7.3 percent of the files it found had already expired. A separate August 2026 scan of 623 European software vendors by CRA Incident Drill found that 76 percent had no valid file at the canonical path.

Four failure modes explain most of the misses.

No channel at all

The researcher guesses an email address, opens a Discord ticket or asks an auditor for an introduction. Every hop leaks the finding to more people.

A channel nobody reads

An expired file, an unattended mailbox or a contact that belongs to the hosting platform. In the IoT Defense scan, 60.3 percent of files pointed to contacts at identifiable platforms rather than at the domain owner.

No written testing limits

In June 2024, Kraken and CertiK argued in public over whether withdrawing close to 3 million dollars to demonstrate a deposit bug was testing or, in the words of Kraken's chief security officer, extortion. The funds went back within days. The argument happened because proof-of-concept limits were never written down.

A promise that was never funded

In March 2026, Protos reported that a researcher who disclosed a bug putting about 500 million dollars at risk in Injective through Immunefi was offered 50,000 dollars against an advertised 500,000 dollar maximum, and that even the smaller sum had not been paid. Injective did not respond to Protos before publication.

Vulnerability disclosure policy wording you can adapt

A vulnerability disclosure policy (VDP) is the human-readable half of the system; the file described in the next section only tells a researcher where the policy lives. Start from the public-domain disclose.io terms rather than from a competitor's page, and have counsel review the result. Nothing here is legal advice.

Seven clauses do the work. Adapt the wording and keep the order, which runs from what a researcher settles before testing to what comes up after a report.

Scope

List the contracts by address and chain, the repositories by URL and commit, and the front end by domain. Say which of them are in scope. A policy that covers "all our systems" is a policy nobody can rely on.

Safe harbor

The disclose.io core terms need four elements: authorization under anti-hacking law such as the CFAA or the Computer Misuse Act, an exemption from anti-circumvention law such as the DMCA, an exemption from your own terms of service during testing, and an acknowledgment that research under the policy is conducted in good faith. A policy that omits the third element leaves its own researchers exposed, because driving a deployed contract from a script usually breaks the front end's terms of use. Name the governing law and the entity granting the authorization as well: a foundation in one jurisdiction and a front end operated from another need the clause to say which law applies.

Testing rules

Reproduce on a local fork. Do not change mainnet state, do not move other users' funds, and stop at the smallest proof that demonstrates impact. Write the limit as a number: "a proof of concept must not move more than X in value on a live network" is the sentence Kraken and CertiK were missing.

Reporting channel

One encrypted channel first (a secure upload form or a PGP key) and one plain mailbox second. Name the fields a usable report contains: affected contract, chain, commit, impact, reproduction steps on a fork and a wallet for the reward.

Response commitments

State the acknowledgment window, the assessment window and the resolution target, using the benchmarks in the table below. A number you can meet beats a number you copied.

Rewards and identity

State whether a bounty exists, where it is hosted, which severity rubric applies and at which severity tier the researcher must complete KYC checks. If the program is escrowed on chain, link the vault.

Coordinated disclosure timeline

Say when the researcher may publish. The Google Project Zero baseline is 90 days to ship a fix plus 30 days for users to apply it, dropping to 7 days when the bug is already being exploited. A protocol that can pause or upgrade within hours can honestly promise a shorter window.

Publish the policy at a stable URL, link it from the SECURITY.md file of every public repository and from the Policy field of security.txt, and put a revision date on it. The researcher-side view of the same process is covered in how to report a DeFi vulnerability and get paid.

A team with no token, no governance vote and no bounty budget can still ship the minimum: the security.txt from the next section with a role mailbox that two people read, the disclose.io core terms adopted verbatim and a published acknowledgment window of three business days. Add the bounty when there is a funded amount to put behind it, not before. Expect the public channel to bring low-quality reports as well, and budget the triage hours for them.

security.txt fields under RFC 9116, one by one

RFC 9116, published in April 2022 as an Informational RFC, defines a plain-text file that scanners and people can find at a fixed location. The rules that trip teams up are short. The file must live at /.well-known/security.txt, it must be served over HTTPS as text/plain, and of its eight fields only two are required. When a copy also sits at the site root, the /.well-known/ copy is authoritative.

Binance's file, one of the three we found, carries a Bug Bounty line that is not an RFC 9116 field, so parsers skip it. The RFC also recommends signing the file with an OpenPGP cleartext signature.

Contact: https://example-protocol.org/security/report
Contact: mailto:security@example-protocol.org
Expires: 2027-06-30T00:00:00.000Z
Encryption: https://example-protocol.org/security/pgp-key.txt
Canonical: https://example-protocol.org/.well-known/security.txt
Policy: https://example-protocol.org/security/disclosure-policy
Preferred-Languages: en

Mirror the same contact in SECURITY.md and in the bounty listing. A researcher looks in those three places, in that order, before asking around.

SEAL Safe Harbor adoption steps and trade-offs

The Security Alliance's Whitehat Safe Harbor is a public, unilateral offer from a protocol to any whitehat: intervene during an exploit that is already in progress or imminent, return the funds to the protocol's recovery address within 72 hours and keep a bounty on the published terms. The protocol never needs to know the whitehat in advance.

SEAL states that the framework covers more than 68 billion dollars across more than 20 protocols, including Uniswap, Aave, Pendle, PancakeSwap, Balancer, Silo Finance and zkSync.

Two limits define what it is not.

• It does not cover a whitehat who starts the exploit. Intervention is covered only once an exploit is in progress or imminent.
• The protocol does not vouch for the lawfulness of the whitehat's actions, so criminal exposure stays with the person acting.

Adoption is a governance decision executed on chain.

1. Set the bounty percentage and the cap. SEAL advises a cap at or below your existing bug bounty maximum, so that a rescue during an exploit never pays better than a report before it and the two programs cannot be played against each other.
2. Choose the identity policy: named with KYC, or anonymous with attestations.
3. Publish the asset recovery addresses, the protected contracts and the chains. The recovery address should be governance-controlled rather than a hot wallet, because it will receive everything a rescuer pulls out.
4. Pass the vote, then record the adoption from the governance address in the SafeHarborRegistry, deployed through CreateX at the same address on every supported EVM chain (0x326733493E143b8904716E7A64A9f4fb6A185a2c). The current registry is V3, audited by Cyfrin in January 2026.
5. Link the adoption from the disclosure policy and from security.txt, so the terms are discoverable during an incident and not only in a forum thread.

The identity choice is the real trade-off. A named policy keeps the treasury clear of sanctions risk but excludes researchers who work pseudonymously. An anonymous policy widens the pool and moves the compliance burden into the attestation wording. Both are defensible. Picking one before the incident is what matters.

Triage deadlines and the first 72 hours after a report

Deadlines are the part of a policy a researcher tests first, usually by waiting. Publish numbers you can meet, then meet them. Name the people behind them: two readers of the mailbox, one escalation contact who can pause or upgrade and a rota that covers nights. Reports arrive when the researcher finishes, not when your team starts.

For a protocol holding user funds, the assessment window is shorter than any of those. This is the sequence that works.

1. Acknowledge within hours with a ticket number, even at night. Silence for three months is what the Injective researcher described.
2. Reproduce on a fork and classify. Immunefi's Vulnerability Severity Classification System v2.3 defines four levels with separate impact tables for smart contracts, websites and blockchains. Nothing stops a protocol from reusing it as a rubric.
3. Decide whether funds are at risk right now. If they are, open a war room and contact SEAL 911 through its Telegram bot. SEAL reports 3,300 tickets handled and 200 war rooms coordinated since launch, but it runs on 31 volunteer responders and does not guarantee capacity, so it complements your channel rather than replacing it.
4. Pause, upgrade or mitigate, then verify the fix on a fork before touching mainnet. The hour-by-hour version of this step lives in the first hours after a DeFi exploit.
5. Pay the reward inside your stated window and tell the researcher when they may publish.
6. Write the post-mortem, naming the root cause and, with consent, the reporter.

Bug bounty economics the platforms leave out

Launch guides from the platforms cover severity tiers and payout ranges well. Three things their launch guides rarely cover decide whether a program ever pays anyone.

How auditors check this

A code audit rarely grades the disclosure channel, so ask for it. Before an engagement closes, have the auditor confirm five artifacts.

• A SECURITY.md in every public repository.
• A security.txt whose Expires date is still in the future.
• A policy page with scope and safe-harbor wording.
• A live bounty, or a Safe Harbor adoption recorded in the on-chain registry with the recovery addresses published.
• A tested pause or upgrade path, with named owners.

The smart contract audit checklist on this site covers the code-side items the same review should include.

Among DeFi Security Alliance members, Hacken operates the HackenProof bounty platform and can host the program the policy points to. Trail of Bits publishes a security.txt that works as a template, with an encrypted upload link ahead of a mailbox and an Expires date in January 2027. On September 2, 2026 it was also the only one of the 20 reachable member websites serving the file at the canonical path. The absence of the file does not mean the absence of a policy, but it does mean a scanner will not find one.

Where a disclosure policy stops helping

A policy changes the behavior of people who wanted to report. It does not deter anyone else, and Chainalysis counted more than 3.4 billion dollars stolen across the industry in 2025, with the Bybit compromise alone at 1.5 billion. Budget for detection and response as if the policy did not exist.

Safe harbor is narrow. SEAL's agreement covers intervention during an active or imminent exploit and nothing before it, and the US Department of Justice policy of May 2022 on good-faith security research governs federal charging decisions under the CFAA, not civil claims and not other jurisdictions. A researcher who reads your policy as blanket permission has misread it, and your wording should say so.

If your contracts are immutable, the "fix" step in the timeline becomes a migration, and the disclosure window must say how long that takes. When a fix cannot ship inside the window the researcher was promised, say so before the deadline and agree a new date in writing. Project Zero's own policy allows a 14-day grace period for exactly that conversation. Designing the stop button before it is needed is the subject of emergency pause and circuit breakers.

Bugs in an oracle, a bridge or a library you integrate are outside your scope but inside your blast radius. Say who coordinates with the upstream team, and expect that team to have no channel either.

A named-only identity policy at the top tier means a pseudonymous researcher cannot be paid for the finding that matters most. Decide in advance whether the treasury accepts that outcome, or write the anonymous variant with attestations as Lido did. And if the software you ship counts as a product with digital elements in the EU, the Cyber Resilience Act's reporting duties start on September 11, 2026 through ENISA's Single Reporting Platform, with a 24-hour early warning for an actively exploited vulnerability.