The OpenSY team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security vulnerabilities by emailing:

📧 security@opensyria.net

Please include the following information in your report:

1. Type of vulnerability (e.g., remote code execution, denial of service, information disclosure)
2. Full paths of source file(s) related to the vulnerability
3. Step-by-step instructions to reproduce the issue
4. Proof-of-concept or exploit code (if possible)
5. Impact assessment - what an attacker could achieve

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution Target: Within 90 days (depending on severity)

We consider security research conducted in accordance with this policy to be:

• Authorized and legal
• Exempt from DMCA anti-circumvention provisions
• Conducted in good faith

We will not pursue legal action against researchers who:

• Report vulnerabilities responsibly
• Do not exploit vulnerabilities beyond proof-of-concept
• Give us reasonable time to address issues before disclosure

We are establishing a bug bounty program. Details will be announced at:

• Website: https://opensyria.net/security
• Twitter/X: @OpenSYcrypto

Bounty amounts (when available):

• Critical: Up to 50,000 SYL
• High: Up to 20,000 SYL
• Medium: Up to 5,000 SYL
• Low: Up to 1,000 SYL

For sensitive communications, you may encrypt your report using our PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
[PGP key will be added here]
-----END PGP PUBLIC KEY BLOCK-----

Key fingerprint: [To be added]

# Limit RPC access to localhost
rpcbind=127.0.0.1

# Use strong RPC credentials
rpcuser=<random_string>
rpcpassword=<strong_random_password>

# Enable wallet encryption
encryptwallet "your-strong-passphrase"

# Consider running behind a firewall
# Only expose port 9633 for P2P (if needed)

• Keep your node software updated
• Run behind a firewall
• Use Tor for enhanced privacy: -proxy=127.0.0.1:9050
• Monitor for unusual activity

Thank you for helping keep OpenSY secure! 🔒