# Security policy

MoonBite is a live proof-of-work network, so a security bug can cost real people real coins. Report it privately, give us time to fix it, and we will credit you.

## Reporting a vulnerability

Email **security@moonbite.org**. Please do not open a public issue or post about it until a fix has shipped.

Include:

- what is affected (node, miner, wallet, website, API) and which version or commit;
- steps to reproduce, or a proof of concept;
- what an attacker could do with it (steal coins, split the chain, crash nodes, read data).

What to expect:

- an acknowledgement within 7 days;
- a fix or a mitigation plan agreed with you, normally within 30 days, sooner for anything that puts coins at risk;
- credit in the release notes, unless you prefer to stay anonymous.

There is no paid bounty programme yet.

## Scope

**In scope**

- The MoonBite node: consensus rules, RandomX proof of work, P2P and RPC (a Litecoin Core v0.21.5.5 fork).
- The miner scripts and download bundles in [`release/miner/`](release/miner/).
- moonbite.org: the website, block explorer, wallet pages and merchant API ([`web_app.py`](web_app.py)).
- The desktop and mobile wallets.
- The seed nodes and release pipeline ([`deploy/`](deploy/)).

**Out of scope**

- Volume denial-of-service against public endpoints (rate limits are known and intended).
- Social engineering, phishing or physical attacks.
- The Python files and `.bat` launchers at the repository root. They are an old educational reference implementation, not the MoonBite network.
- The 51% risk described below, which is already public.

## Known risks

These are known and disclosed. You do not need to report them, but ideas to reduce them are welcome.

| Risk | Status |
| --- | --- |
| **Low hashrate.** Total hashrate is a few kH/s, most of it from the founder ([ADR-006](docs/ADR-006-founder-mining-disclosure.md)). Anyone with modest CPU power could out-mine the network and reorganise recent blocks. | Open. Wait for many confirmations before treating a large payment as final. |
| **No independent audit.** Internal audits only (below). | Open. |
| **Release signing.** Releases publish SHA-256 hashes and are built reproducibly, but the minisign signing key is not set up yet, so hashes prove integrity, not who published them. | Open. |
| **Two seed nodes**, run by the same operator. | Open. More community nodes are welcome. |

## Verifying releases

- Compare every download against `SHA256SUMS.txt` from moonbite.org. The miner also prints the hash of the binaries it is about to run.
- Rebuild and compare: [`docs/REPRODUCIBLE-BUILDS.md`](docs/REPRODUCIBLE-BUILDS.md).
- The miner never installs itself, adds startup entries or asks for admin rights ([`release/miner/ANTIVIRUS.md`](release/miner/ANTIVIRUS.md)).

## Past internal audits

| Date | Report |
| --- | --- |
| 2026-10-09 | [Whole-infrastructure audit](AUDIT_INFRA_FULL_2026-10-09.md) |
| 2026-10-09 | [Bug bounty, mainnet and wallet](AUDIT_BUG_BOUNTY_2026-10-09.md) |
| 2026-10-09 | [Fork delta vs upstream Litecoin](AUDIT_FORK_DELTA_2026-10-09.md) |
| 2026-10-09 | [Live chain](AUDIT_LIVE_CHAIN_2026-10-09.md) |
| 2026-10-03 | [Backdoor hunt, pass 2](AUDIT_BACKDOOR_HUNT_2026-10-03_PASS2.md) |

## Safe harbour

Good-faith research that follows this policy is welcome. We will not pursue legal action for it. Please:

- test on testnet or regtest, or against your own node, wherever you can;
- never take or move coins that are not yours;
- never access other users' data beyond what is needed to show the problem;
- avoid degrading the network or website for others.