Dakota

Vulnerability Disclosure Policy

Last updated September 28, 2026

Dakota welcomes reports from security researchers and anyone else who believes they have found a vulnerability in our systems. This page explains how to report one, what you can expect from us, and the ground rules for testing.

security@dakota.xyz

Report a vulnerability to the security team.

How to report

Email security@dakota.xyz and include as much of the following as you can:

  • The affected asset: a URL, API endpoint, or on-chain program address and network.
  • A description of the vulnerability and its potential impact.
  • Steps to reproduce it, including any proof-of-concept code or transactions.
  • How we can reach you for follow-up, and whether you would like to be credited.

Please report privately to us first, and do not share details with others until the issue has been fixed.

What to expect

  • We will acknowledge your report within 3 business days.
  • We will investigate, confirm whether the issue is valid, and keep you informed of our progress.
  • We will let you know when the issue has been resolved.
  • With your permission, we are happy to credit you publicly once a fix is in place.

Scope

This policy covers:

  • dakota.xyz and its subdomains.
  • The Dakota Platform, including its APIs.
  • On-chain programs and smart contracts deployed by Dakota.

The following are out of scope: services operated by third parties (report those to the vendor), denial-of-service testing, social engineering or phishing of Dakota staff or customers, physical attacks, and reports from automated scanners without a demonstrated impact.

Testing guidelines

When investigating a vulnerability, please:

  • Use only your own accounts and data. If you encounter data belonging to someone else, stop, do not keep or share it, and tell us.
  • Do only what is necessary to demonstrate the issue. Do not degrade our services or modify or delete data.
  • For on-chain programs, demonstrate issues on a local validator, fork, or test network. Do not move, lock, or put at risk funds that belong to Dakota or anyone else on mainnet.
  • Do not attempt to extort Dakota or make disclosure conditional on payment.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue legal action against you for it, and we will work with you to understand and resolve the issue quickly. If you are unsure whether something is allowed, contact us before you proceed.

Rewards

Dakota does not currently operate a paid bug bounty program. If that changes, this page will be updated.