Security

1. Reporting a Vulnerability

Email security@sygne.xyz with what you found, the steps to reproduce it, the URL or endpoint involved, and what an attacker could do with it. Screenshots or a short proof of concept help. Please do not report security issues through Telegram, X, Discord or other public channels.

We will confirm we received your report within three business days, and tell you what we plan to do within ten. We will keep you updated until it is fixed, and let you know when it is.

2. Scope

This policy covers:

• therewillbesigns.io, including the API under therewillbesigns.io/api.
• sygne.xyz, which shares Signs Club's sign-in and database.

Out of scope:

• The services we rely on, such as Supabase, Vercel, Helius or WalletConnect. Report issues in them to the vendor.
• The SIGNS token and other on-chain programs, and wallets or wallet apps.
• Denial of service, load or volume testing, and spam.
• Social engineering, phishing or physical attacks against us, our members or our vendors.
• Scanner output without a demonstrated impact, such as a missing header, a software version, or a rate limit you could not use to cause harm.

3. Rules for Testing

• Use only wallets and accounts you control. Don't access, change or delete anyone else's data. If you reach other members' data by accident, stop, keep only what you need to show the issue, and tell us.
• Don't degrade the service for others, and keep automated tools to a gentle rate.
• Don't use a flaw to claim rewards, referral payouts, ranks or votes beyond what you need to show it.
• Give us a reasonable time to fix the issue, normally 90 days, before you tell anyone else about it.
• Delete any data you obtained once the report is closed.

4. Safe Harbor

If you research and report in good faith and follow this policy, we will treat your research as authorized, will not take legal action against you over it, and will not report it to law enforcement. If a third party brings legal action over research that followed this policy, we will make it known that the research was authorized. If you are unsure whether something is allowed, ask us at security@sygne.xyz first.

This does not cover research that breaks the rules above, or demands for payment in exchange for not disclosing an issue.

5. Recognition

We don’t run a paid bug bounty. With your permission, we are glad to credit you by name or handle once the issue is fixed.

6. We Will Never Ask for Your Keys

Nobody from Signs Club or Sygne will ever ask for your seed phrase or private key, ask you to sign a transaction to “verify” your wallet, or DM you first about an airdrop or claim. Any message that does is not from us. Please forward it to security@sygne.xyz.