Report a security issue

Email [email protected] with “SECURITY” in the subject. Include the version or commit, the steps, and what you saw.

Never send a private key, seed phrase or exchange API secret. We will never ask for one.

In scope

• The open-source SDK and MCP server: github.com/PERPBRAIN/perpbrain-sdk
• The receipt verifier (/verify)
• perpbrain.com
• From the testnet bug hunt onwards: the live-order path on Hyperliquid testnet

Out of scope

• Hyperliquid itself (please report to Hyperliquid)
• Denial-of-service, social engineering and physical attacks
• Findings that need an already-compromised user machine
• Testing against other people’s wallets, or on mainnet

What we do

We reply within 3 working days, and give a severity and a fix plan within 10. When the fix ships, we credit you in the hall of fame unless you’d rather not be named. Please give us 90 days, or until a fix ships if that’s sooner, before you publish.

No cash bounty

We don’t pay rewards. We offer public credit in the hall of fame and a mention in the release notes. Valid reports rated Medium or higher also earn founding-tester status.

Safe harbour

If you make a good-faith effort to follow this policy, test only on testnet or your own accounts, don’t access other people’s data or funds, and give us time to fix the issue, we won’t pursue or support legal action against you for that research.

PerpBrain’s limits are limits you set; losses are still possible.

Hall of fame

No reports yet. Be the first.

Machine-readable contact: /.well-known/security.txt