# memetics.finance — security disclosure policy (RFC 9116)
# https://memetics.finance

Contact: mailto:fomotsar@gmail.com
Expires: 2027-07-12T00:00:00.000Z
Preferred-Languages: en
# RFC 9116 §3: a Canonical URI must be a place this file is served, or a strict
# parser distrusts the whole file. The venue serves it on SITE_URL's host only
# (frontend/src/lib/constants.ts).
Canonical: https://memetics.finance/.well-known/security.txt

# ── In scope ──────────────────────────────────────────────────────────────
#   - TOWELI token: 0x420698CFdEDdEa6bc78D59bC17798113ad278F9D (Ethereum mainnet)
#   - memetics.finance smart contracts (the source verified on the block explorer is authoritative)
#   - The dapp at https://memetics.finance and its serverless API.
#   - Two Solana mainnet programs: cp-swap, the pool program,
#     EKS4C6xvV9A5DMWaWtVnFvi7ru78EhqRAoddEMpQ2BtT, and tegridy-launch, the bonding curve,
#     64WBTeNcrSHfmBpiqymyifW6FUNNLvJcuiqF9rXmz4q2. Neither is audited.
# Nothing else is in scope. memetic.fun and www.memetic.fun serve the Island Lab, a
# separate application, not this venue. The tegridyfarms.vercel.app deploy alias is
# not in scope either: this document cannot promise safe harbour on a hostname under
# a domain the project does not own, and a researcher following it could have tested
# someone else's deployment.
#
# ── How to report ─────────────────────────────────────────────────────────
# Please report vulnerabilities PRIVATELY to the contact above BEFORE any public
# disclosure or on-chain exploitation. Good-faith researchers acting under
# responsible disclosure will not be pursued, and will be credited. Do NOT run
# destructive tests against mainnet — use a fork (Tenderly / Anvil).
#
# For an in-progress drain, the SEAL 911 emergency responder network can help:
#   https://securityalliance.org/our-work/seal-911   (responders NEVER need your keys)
#
# No paid bug-bounty program is live yet. If/when one launches it will be linked here.