Security

Email security@sygne.xyz with what you found, the steps to reproduce it, the URL or endpoint involved, and what an attacker could do with it. Screenshots or a short proof of concept help. Please do not report security issues through support, social media or public channels.

We will confirm we received your report within three business days, and tell you what we plan to do within ten. We will keep you updated until it is fixed, and let you know when it is.

This policy covers:

• sygne.xyz and its subdomains, including the API under sygne.xyz/api.
• therewillbesigns.io (Signs Club), which shares Sygne's sign-in and database.

Out of scope:

• The services we rely on, such as Stripe, Supabase, Vercel, Resend or Helius. Report issues in them to the vendor.
• The SIGNS token and other on-chain programs, and wallets or wallet apps.
• Denial of service, load or volume testing, and spam.
• Social engineering, phishing or physical attacks against us, our users or our vendors.
• Scanner output without a demonstrated impact, such as a missing header, a software version, or a rate limit you could not use to cause harm.

• Use only accounts you created yourself. Don't access, change or delete anyone else's data. If you reach other users' data by accident, stop, keep only what you need to show the issue, and tell us.
• Don't degrade the service for others, and keep automated tools to a gentle rate.
• Don't pay for a plan with someone else's card, or use a flaw to get paid features beyond what you need to show it.
• Give us a reasonable time to fix the issue, normally 90 days, before you tell anyone else about it.
• Delete any data you obtained once the report is closed.

If you research and report in good faith and follow this policy, Sygne Labs, LLC will treat your research as authorized, will not take legal action against you over it, and will not report it to law enforcement. If a third party brings legal action over research that followed this policy, we will make it known that the research was authorized. If you are unsure whether something is allowed, ask us at security@sygne.xyz first.

This does not cover research that breaks the rules above, or demands for payment in exchange for not disclosing an issue.

We don’t run a paid bug bounty. With your permission, we are glad to credit you by name or handle once the issue is fixed.

Nobody from Sygne or Signs Club will ever ask for your seed phrase, private key or password, or ask you to sign a transaction to “verify” your wallet. Any message that does is not from us. Please forward it to security@sygne.xyz.