Security
Last updated 2026-08-10 · machine-readable: security.txt
Reporting
Email [email protected]. Include what you did, what happened, and how to reproduce it. If live funds are at risk, say so in the subject line and send a rough report immediately rather than a polished one later.
We cannot undo an exploit. This is non-custodial software on an immutable ledger: we cannot freeze funds, reverse transactions, or patch a deployed contract. A contract bug is permanent for every instance already deployed. That is why we would rather hear about a suspicion early than a confirmed exploit late.
In scope
1bitclaw.comand the application code it servesapi.1bitclaw.com,ums.1bitclaw.com,chat.1bitclaw.com,tg-ws.1bitclaw.com- sCrypt contracts published by this project, and the client-side maths that mirrors them
- Key handling in the browser, transaction construction, and the outbox broadcast path
Out of scope
- The Bitcoin SV network, miners, and consensus behaviour
- Third-party indexers we read from (WhatsOnChain, Bitails) and their outages
- Applications published by third parties on this platform
- The fact that on-chain data is public and permanent — that is documented in Privacy, not a vulnerability
- Reports generated solely by automated scanners with no demonstrated impact
Please do not
Do not test against other people's funds, contracts, or data. Do not run denial-of-service or spam tests against the indexers or relay. Do not exfiltrate data beyond the minimum needed to demonstrate the issue. Use your own keys and your own small amounts — testnet where possible.
What you can expect
An acknowledgement, an honest assessment of severity, and a straight answer about whether and when it will be fixed — including "we are not going to fix this, and here is why", when that is the truthful answer. We will credit you if you want credit. There is currently no paid bounty programme; we will not pretend otherwise.
Known posture
No external security audit has been performed to date. Internal audits exist but were written by the same people who wrote the code, which is a real limitation and we state it rather than omit it.