Security
Responsible disclosure
How to report a security issue in Rtp.Fun, what we commit to in return, and the safe-harbor terms for good-faith research.
We welcome reports from security researchers and treat every one seriously. If you find a vulnerability, tell us privately first and we will work with you to fix it.
How to report
Section titled “How to report”Email security@rtp.fun. The same address is listed on Support and channels and in our /.well-known/security.txt.
A useful report includes the affected surface, the conditions to trigger the issue, what an attacker gains, and steps to reproduce it. A short report of a real issue beats a polished report of a theoretical one.
Our commitments
Section titled “Our commitments”| Acknowledgement | Within 3 business days |
| First assessment | Within 10 business days — severity, whether we can reproduce it, and a timeline |
| Fix and disclosure | Coordinated with you; details are published once a fix has shipped |
| Credit | Named, anonymous or unattributed — your choice |
Safe harbor
Section titled “Safe harbor”For research within the scope below that is reported privately, we will not pursue legal action and will not ask anyone else to. This covers the research; it does not cover access to other people’s accounts or funds.
In scope: the Rtp.Fun website, terminal and docs, the Wallet at wallet.rtp.fun, and the Rtp.Fun launch configurations listed on Contracts and addresses.
Out of scope:
| Third-party platforms and chains | Report to their own teams |
| A compromised user device | Outside what any web wallet can defend |
| Volumetric or denial-of-service testing | Not authorized against production — tell us instead |
| Missing hardening headers with no demonstrated impact | Welcome as suggestions |
| Social engineering of our team or users | Not permitted |
Please don’t
Section titled “Please don’t”Access, change or copy anyone else’s data; test denial of service against production; or move funds that are not yours — a proof of concept that stops short of that is enough. If you come across someone else’s data or funds, tell us at once.
security.txt
Section titled “security.txt”Rtp.Fun publishes a security.txt file at /.well-known/security.txt (RFC 9116). It names the reporting address above and carries an expiry date.
Related: Security and custody · Contracts and addresses · Support and channels