Security policy

Report a security problem to hello@udao.org.

What you may test

This site, its API, the embeds, and our two contracts on the Amoy test network: the one that holds each campaign's budget, and the one behind the public record. Once they are on Polygon, report a fault there without exploiting it.

What is not covered

The outside companies' own systems (hosting, database, mail, sign-in, chain access and card payments), denial of service, and tricking or pressuring people. How this site uses them, such as its sign-in checks and the rules on who may read our data, is covered.

How to test

Use only accounts you made yourself, never touch other people's data, and do no more than proving the fault needs. Tell nobody else until it is fixed or we agree a date with you.

What we do

We confirm your report within 3 working days and tell you what we found within 5. We aim to fix it within 60 days and agree with you when it is made public.

Rewards

There is no reward program.

Legal action

We will not file a complaint or take civil action over good-faith research within this scope that follows these rules. This is our own promise: it does not authorize access, and it cannot bind anyone else.