> For the complete documentation index, see [llms.txt](https://whitepaper.litho.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.litho.ai/security.md). # Security Policy ## Supported Versions | Version | Supported | | ------------------------ | --------- | | Makalu Testnet (current) | Yes | ## Reporting a Vulnerability We take security seriously. If you discover a security vulnerability in the Lithosphere protocol, explorer, APIs, or any associated infrastructure, please report it responsibly. ### How to Report * **Email**: * **Subject line**: `[SECURITY] ` * **Include**: Steps to reproduce, affected components, potential impact, and any suggested fixes ### What to Expect 1. **Acknowledgment**: We will acknowledge receipt of your report within 48 hours. 2. **Assessment**: Our team will assess the severity and impact within 5 business days. 3. **Resolution**: We will work on a fix and coordinate disclosure with you. 4. **Credit**: With your permission, we will credit you in the security advisory. ### Scope The following are in scope for responsible disclosure: * Lithosphere node software (`lithod`) * Explorer and block explorer APIs (`makalu.litho.ai`) * Public RPC endpoints (`rpc.litho.ai`, `api.litho.ai`) * Smart contract standards (LEP100) * SDKs and developer tools ### Out of Scope * Denial-of-service attacks against production infrastructure * Social engineering of team members * Third-party services not operated by Lithosphere ### Disclosure Policy * Do not publicly disclose the vulnerability before we have had a chance to address it. * Do not exploit the vulnerability beyond what is necessary to demonstrate it. * Do not access or modify data belonging to other users. ## Security Audits Lithosphere is actively pursuing third-party security audits. Completed audit reports will be published here with scope statements and remediation status as they become available.