Copra Protocol treats smart contract security as the highest priority.

If you discover a security vulnerability within Copra Protocol smart contracts or infrastructure, please do NOT disclose it publicly on GitHub issues or social media.

Please report vulnerabilities directly via:

• GitHub private vulnerability reporting (preferred): open the Security tab and click Report a vulnerability, or go straight to the advisory form. Only you and the maintainers can see the report, and we can work on the fix with you in a private fork.
• Email: security@copra.dev

The same contacts are published at copra.dev/.well-known/security.txt (RFC 9116).

Please include:

1. Detailed description of the vulnerability.
2. Steps or proof-of-concept (PoC) code to reproduce the issue.
3. Potential impact and severity assessment.

1. Acknowledgment: We acknowledge receipt of vulnerability reports within 24 hours.
2. Investigation: The engineering team verifies and validates the issue.
3. Mitigation: A fix is prepared, tested in an isolated environment, and deployed.
4. Disclosure: Coordinated public disclosure after mitigations are live.