Vulnerability Disclosure Policy

Last updated: November 9, 2026
Security contact: [email protected]

We want to hear about security problems in Unclaimed SOL. This policy explains what it covers, how to test safely, how to report a problem and what you can expect from us.

1. Scope

This policy covers:

  • the Unclaimed SOL on-chain program, UNCaXzXkR3vp8mbCJyxWUvwuRk5uHgzrwe6jcWPfiUR;
  • the app at unclaimedsol.com and its APIs, including the RPC gateway and the gasless relay;
  • official packages and integrations we publish, including @unclaimedsol/spl-burn-close-sdk, @unclaimed-sol/mcp and the public Unclaimed wallet SDK.

Issues we most want to hear about include loss or theft of user funds, transactions that do something other than what the review screen shows, fee or cashback manipulation, drain of the relay wallet, and access to data or administrative functions you should not have.

2. Out of scope

  • third-party protocols, wallets and infrastructure. Please report those to their operators. Tell us as well if the problem affects how our product uses them;
  • phishing, social engineering or physical attacks on people or systems;
  • denial of service, load testing or attempts to exhaust rate limits;
  • automated scanner output or missing security headers with no demonstrated impact;
  • lookalike sites and fake accounts. You can still tell us about them, but they are not vulnerabilities in our product.

3. Testing rules

  • Use your own wallets and accounts. Prefer a local validator or transaction simulation, and use mainnet only with funds you control.
  • Leave other people's funds, accounts and data alone. If you reach someone else's data by accident, stop, do not keep a copy and tell us.
  • Sponsored transactions spend our funds. Do not submit them repeatedly, and use simulation where it can demonstrate the issue.
  • Stop as soon as you have enough to demonstrate the problem. Do not move funds, keep access or chain the issue further to show more impact.

4. How to report

Email [email protected] with "Security report" in the subject line. Please include:

  • what is affected and the impact you believe it has;
  • steps to reproduce, with any transaction signatures, simulation output or proof of concept;
  • whether anything happened on mainnet, and any wallets involved.

Never send us a private key or seed phrase, including your own. Please do not report vulnerabilities through public channels such as social media, Discord or public issue trackers.

5. What you can expect

  • We aim to acknowledge your report within 3 business days.
  • We aim to give you an initial assessment within 10 business days, and to keep you informed while we work on a confirmed issue.
  • We will tell you when a confirmed issue is fixed.

Please give us 90 days from your report before publishing, or longer if we agree that a fix needs it. A fix to the on-chain program takes a program upgrade, and funds at risk may need separate handling.

6. Good-faith research

We will not pursue legal action against you for research that follows this policy in good faith. This policy is the separately published programme that our Terms of Service refer to for security research. It cannot authorise testing of systems that other parties operate.

7. Rewards

This policy does not offer a paid bounty. Any reward for a security report is at our discretion and is confirmed in writing.

8. Your information

We use what you send us to investigate and respond to your report. Our Privacy Policy applies. We may share technical details with a third party whose product is affected, and we will not name you without your agreement.