Security.

1. Reporting vulnerabilities

If you discover a security vulnerability in EqubFlow, report it directly via email to:

Please include detailed steps to reproduce the issue. We commit to acknowledging receipt within 24 hours.

2. Scope and safe harbor

In scope: Bypasses of the payout authorizer, double-payout vulnerabilities, row-level security leaks between groups, and prompt injection attacks that alter financial balances.

Out of scope: Volumetric denial-of-service (DDoS), social engineering, or spamming public RPC testnet nodes.

We commit not to pursue legal action against researchers acting in good faith under these terms. As this is an unpaid hackathon prototype, we do not offer financial bug bounties.

3. What we have done

• Enforced strict process separation: wallet private keys reside exclusively in the isolated executor process.
• Architected the deterministic authorizer to fail closed: if any condition is unmet, zero funds move.
• Implemented database Row-Level Security (RLS) on all tables with tenant isolation.
• Automated 73 unit and integration tests across the domain and web applications.

4. What has not been done

EqubFlow has not undergone an external third-party security audit by an independent cybersecurity firm. It remains experimental testnet software.