You send findings through GitHub's private vulnerability reporting, with the affected revision, a reproduction, the violated invariant, privileges needed, and a proposed mitigation. Public discussion waits until a fix exists or the report falls out of scope. The threat model names ten protected assets, five trust boundaries, seventeen attacks, and six residual risks, so you read what the protocol does not protect. Rewards are tiered by severity, from $100-$1,000 for low findings to $10,000-$50,000 for critical ones.

What it does

Paxeer X Network publishes a security policy that defines what counts as a security issue, how to report one privately, and which research activities are prohibited. Any defect that can affect value conservation, authority, finality, data availability, replay determinism, withdrawal uniqueness, upgrade safety, or private key handling is treated as a security issue and goes through GitHub's private vulnerability reporting flow rather than a public issue, discussion, or pull request. The assumptions and exclusions behind that policy are normative in the threat model, which names what the protocol does not protect. A separate governance document states who merges changes, how maintainers are added, and that protocol, consensus, custody, and trust-boundary changes need a requirement and task in spec/ before implementation.

Key capabilities

• Private-only intake from the repository Security tab; public issues, discussions, and pull requests are refused.
• Required report fields: affected revision, reproduction, violated invariant, privileges needed, proposed mitigation.
• Coordinated disclosure: public discussion only after a fix exists or the report is ruled out of scope.
• Residual assumptions named in a normative threat model instead of implied guarantees.
• Spec-first change process, plus review by at least one maintainer who did not author the change.
• Tiered rewards by severity, from $100-$1,000 for low findings to $10,000-$50,000 for critical ones.

Differentiators

Three commitments are written into the documents themselves. The threat model requires every mitigation to name an enforcement point, and treats a mitigation with no enforcement point as a release blocker. It forbids any document, UI, or SDK from describing checkpoint finality as "proven", because a checkpoint means a threshold of bonded guarantors claims to have replayed a batch, not that the transition was valid. Governance allows a security fix to land on main before the matching specification text is regenerated, but requires the specification to be updated within the same disclosure window.

Outcomes

• Send findings privately with the evidence maintainers already asked you to include.
• Read the named residual assumptions instead of inferring what stays protected.
• Every trust-boundary change carries a written requirement and a second reviewer.

Technical notes

• Supported branch is main. Availability of source or a passing test suite is not a deployment recommendation.
• Prohibited research: probing public infrastructure, validators, custody deployments, user data, or third-party systems; moving funds; publishing exploit details; retaining secrets obtained during research.
• Reward tiers as published: Critical $10,000-$50,000, High $5,000-$10,000, Medium $1,000-$5,000, Low $100-$1,000.
• Stated residual assumptions: guarantor threshold signatures are economic attestations, not validity proofs; the sequencer is a liveness and short-horizon ordering trust role; emergency exit depends on the last finalized checkpoint and Paxeer contract availability; local, sanitizer, fuzz, replay, and proof results do not replace independent contract review or a controlled deployment process.
• The threat model is normative, version 1, protocol tag LXP1: ten protected assets (A1 to A10), five trust boundaries (B1 to B5), seventeen catalogued attacks, six residual risks, and an emergency exit with four independent triggers.
• Maintainers are the Sidiora Labs core team; .github/CODEOWNERS routes every path to @Sidiora-Labs/core. Maintainer status is not implied by a merged contribution, and generated files are not an independent source of truth.
• Pull requests carry Developer Certificate of Origin sign-off, cite the requirement and task, and record the exact verification commands and outcomes. Conduct reports that are not product vulnerabilities use the same private path.
• This is policy and process enforced by review and repository configuration, not by protocol code.

More in Network