How to report a vulnerability in the NeuraMesh website, serverless routes or published source, what is in scope today, and what the security posture honestly is.
Report a vulnerability
Email rishitd346@gmail.com or open a private issue at github.com/Rish0x29/neuramesh/issues. Include the URL, steps to reproduce and impact. We acknowledge within five working days. The machine-readable version of this policy is at /.well-known/security.txt.
Scope
In scope: neuramesh.xyz pages, the /api/* routes, the provider application flow, the published Move sources, node agent and SDK in the repository. Out of scope: third-party services we proxy (Akash, Yahoo Finance, formsubmit.co), denial-of-service, and social engineering of team members.
Current posture
Contracts: not deployed; audit: none yet; bug bounty: none yet. The website sends strict transport security, content-type, referrer, permissions and frame headers, and a Content-Security-Policy in report-only mode while wallet flows are validated against it. Secrets are held in environment variables, never in source. The site holds no user accounts, keys or funds.
Safe harbour
Good-faith research that respects scope, avoids privacy violations and data destruction, and gives us reasonable time to fix before disclosure will not be met with legal action.
Questions, answered.
Has NeuraMesh been audited?
No. There is nothing deployed to audit yet. The site will say so until an audit is complete and linked here.
Is there a bounty?
Not yet. Reports are still welcome and credited.
Check the official links.
Phishing is the most likely attack on a project like this. One page lists every real channel.
Official links →