How to report privately

1. Do not post details in public: not in the Telegram group, on X, on GitHub or anywhere else.
2. In the official Telegram group t.me/moonxwin, post only: "Security report for the MoonVault team, please contact me privately." No details, no screenshots.
3. A group admin will reply there and start a private chat with you. Before you share anything, check that the account is listed as an admin of t.me/moonxwin. Anyone who messages you first, before you posted, is not us.
4. Send the details in that private chat.

What to include

• What is affected: the contract address, the page or the API route.
• Steps to reproduce. A test on a local fork or a proof of concept is best. Never test against live funds.
• The impact: what an attacker could take, lock or break, and under what conditions.
• Optional: a name, handle or wallet address if you would like to be credited.

We never ask for

Safe harbour for good-faith research

If you act in good faith, we will not take legal action against you for your research or ask anyone else to. Good faith means: test only on a local fork or a copy of the chain, never against live funds or other people's accounts; do not access, change or keep other people's data; do not disrupt the site or the keeper; report to us privately and give us reasonable time to fix the issue before you disclose it. This does not permit breaking the law, and it cannot bind third parties such as PulseChain, bridges or token issuers.

No paid bug bounty yet

There is no paid bug bounty programme at the moment, and we cannot promise a payment for a report. If that changes, it will be announced on moonvault.win and in t.me/moonxwin first.

MoonVault is run by a small team, so please allow time for a reply. Our contracts have not had an independent external audit.