PulseGrid settles real value (canonical USDT) on BOT Chain mainnet, so we take security seriously. This document explains how to report a vulnerability and what to expect. For the current security posture (what has and has not been reviewed), see the Security page.

Please report suspected vulnerabilities privately. Do not open a public issue, pull request, or social post for a security bug, and do not exploit it against mainnet.

• Email: emmanuelolamiye@gmail.com with the subject line PulseGrid security.
• Include: a description, the affected component and version/commit, a proof of concept or reproduction steps, and the impact you believe it has. If you need to share sensitive detail, say so and we will arrange a secure channel.

We will acknowledge your report, keep you updated as we investigate, and credit you (with your permission) once a fix ships. We ask that you give us a reasonable window to remediate before any public disclosure.

In scope:

• The Solidity contracts in contracts/ and the deployed mainnet instance (chainId 677): DeviceRegistry, TelemetryAnchor, ServiceContract, PolicyModule, SettlementVault.
• The Go agent in agent/ (the sponsor relayer, the Settlement Agent, the device SDK).
• The Next.js app in web/ (server-side chain reads and wallet write paths).

Out of scope:

• Third-party infrastructure we do not control (BOT Chain nodes and RPC, Google Fonts, hosting providers, the wallet extension).
• The MockUSD test token (local development only).
• Denial-of-service that only affects a single self-hosted relayer or settler instance (these are designed to be permissionless and replaceable; on-chain policy remains the settlement authority).
• Findings that require a compromised operator machine, browser, or private key.

The core invariant is that on-chain policy is the sole settlement authority: no caller of settleEpoch(deviceId, epoch) can overpay, wrongly slash an honest operator, pay an un-anchored or out-of-range interval, or double-settle. Anything that breaks that, that lets one party spend another party's escrow or bond, that forges or replays a device signature, or that drains the vault, is high severity.

The contracts have an internal, AI-assisted security and correctness review and an adversarial Foundry test suite (see the Security page). They have not yet had a third-party audit, and there is no paid bug-bounty program yet. Both are planned; see the roadmap. Treat the deployment accordingly and do not commit funds you cannot afford to lose.

We will not pursue or support legal action against researchers who report vulnerabilities in good faith, follow this policy, avoid privacy violations and service disruption, and do not exploit the issue beyond the minimum needed to demonstrate it.