NEAR values the independent security research community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users.
Please do NOT open a GitHub Issue to report a security vulnerability. If you believe you have found a security vulnerability, please submit a report via HackenProof, including a proof of concept and a suggested fix.
We ask that you do not use other channels or contact project contributors directly.
Security-related topics that are not vulnerabilities, such as new ideas for security features, are welcome on GitHub Issues.
Security updates will be released on a regular cadence. Each repository maintains its own cadence for updates and announcements, so please consult the README or release notes of each repository.
We will provide security-related information, such as a threat model, considerations for secure use, or any known security issues, in our documentation. Please note that labs and sample code are intended to demonstrate a concept and may need to be hardened further before production use.
NEAR uses HackenProof as the primary channel for reporting defects and vulnerabilities. To report a vulnerability that you believe you have discovered in the NEAR Platform, NEAR Protocol, or NEAR Intents, please use one of the following programs:
- NEAR Protocol: https://hackenproof.com/near/near-protocol
- NEAR Web: https://hackenproof.com/programs/near-web
- NEAR Smart Contract: https://hackenproof.com/programs/near-smart-contracts-1
- NEAR Intents
- NEAR Foundation Web (Low): https://hackenproof.com/near/near-foundation-web-low
If you cannot submit your report via HackenProof, please let us know the reason via security@near.org or security@nearone.org, so we can assist you.