Responsible disclosure
Found a security problem? Tell us privately so it can be fixed before anyone is harmed.
What to report
- Anything that could let someone move funds, sign for another wallet, or change a transaction a user is about to approve.
- Ways to read or change another person's project, account or private data.
- Ways to fake a launch, a payment, a referral payout or an airdrop.
- Ways to take over the SPAWN Telegram bot, or post through it.
Please do
- Give us the steps to reproduce the problem, the page or address involved, and any transaction signatures.
- Use your own wallets and test with small amounts.
- Give us reasonable time to fix the problem before you share it publicly.
Please do not
- Access, change or delete other people's data, or move funds that are not yours.
- Run tests that slow the site down or flood it with requests.
- Use social engineering or phishing against the team or the community.
- Post the details in a public channel before it is fixed.
What to expect
- We read every report and reply to the contact you give us.
- We will tell you whether we can reproduce it and what we plan to do.
- SPAWN does not run a paid bug bounty at this time. With your permission, we are glad to credit you once a fix is live.
- We will not take action against anyone who reports a problem in good faith and follows this page.
Send a private report
Only the SPAWN team can read this. Never include a seed phrase or private key; we will never ask for one.
To flag a scam token, a copied project or stolen artwork, use the Report link on that page instead. For how SPAWN handles wallets and signatures, see Security. For live service health, see Status.