Security and Responsible Disclosure

Soqucoin is post-quantum infrastructure, so security reports are taken seriously and handled quickly. If you believe you have found a vulnerability, please report it privately using one of the channels below rather than opening a public issue.

How to report

• Email: dev@soqu.org. A PGP key is available on request; ask before sending sensitive details and encrypt the report.
• GitHub: open a private security advisory on the soqucoin/soqucoin repository.

Please do not disclose the issue publicly until a fix is available and a disclosure timeline has been agreed.

What to include

• A clear description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• The affected component (consensus, cryptography, node, wallet, or bridge) and version or commit.
• Any suggested remediation.

What to expect

• Acknowledgement within 24 hours.
• A fix developed on a private branch, prioritized by severity. Critical consensus issues (chain split, inflation, signature forgery) are treated as top priority.
• Coordinated disclosure: public details are shared only after a fix is live or a credible timeline is agreed with the reporter.

Scope

The highest-value targets are consensus rules, the ML-DSA-44 signature path, AuxPoW handling, and the USDSOQ authority logic. Note that Soqucoin is pre-mainnet: the current public network is stagenet, and several features (USDSOQ on mainnet, the covenant opcodes, the bridge) are gated pending a Phase 2 audit. Reports against stagenet and the current codebase are welcome.

A bug bounty for critical consensus issues is planned for mainnet launch. Details will be published here when the program opens.