// LEGAL

Responsible Disclosure

How we work with security researchers: what is in scope, the rules, and what we promise in return.

Last updated: 29 October 2026

Security is what we build for, so we welcome reports from researchers. If you find a vulnerability, report it privately and give us time to fix it. In return we will work with you in good faith and won't take legal action against research done under this policy.

In scope#

Out of scope#

  • Third-party services we use (Privy, Cloudflare, model providers, wallets, Robinhood Chain itself): report to them directly
  • Denial of service, load or spam testing
  • Social engineering, phishing or physical attacks on our team or users
  • Missing best-practice headers or banners without a demonstrated security impact
  • Issues that need a compromised device or wallet
  • Model outputs themselves (a model saying something wrong is not a vulnerability in Stardust)

Rules of engagement#

  • Never move or lock real funds. Prove smart contract issues on a local fork of mainnet or on Robinhood Chain testnet.
  • Only use accounts and wallets you own. Don't access, change or delete other users' data; if you see any by accident, stop and tell us.
  • Don't degrade the service for others, and stay within the API rate limits.
  • Keep the details private until we have fixed the issue and agreed on disclosure with you.

What we commit to#

  • Acknowledge your report within 3 business days.
  • Keep you updated while we investigate and fix, and tell you when it is resolved.
  • Credit you publicly if you want, once the fix is live.
  • Consider a reward for valid, impactful findings, case by case.

Safe harbor#

Research done in good faith and in line with this policy is authorized. We won't pursue legal action against you for it, and if a third party does, we will make clear that you acted under this policy.

Ready to report? Go to Report Security Issue.