Security
Report a vulnerability
Found a bug in the Velos program or this site? Tell us privately first, so it can be fixed before anyone loses funds.
How to report
Email [email protected] with:
- what's affected: the program, a page, or an API route;
- how to reproduce it, ideally on devnet or a local validator;
- what an attacker could do with it;
- how you'd like to be credited, if at all.
Please don't:
- use it on mainnet beyond what's needed to show it, or touch anyone else's funds or data;
- flood the site or the network;
- share it publicly until it's fixed.
What's in scope
- The Velos program,
71mrqbxZcyCkt8Hj3BtYZZ85VjCJUpikCsa8gFUZN6Kw, which carries a security.txt with this contact. - This site and its API (
/api/…), including the co-signing of buys and the referral and rewards payouts.
Out of scope: the programs Velos builds on (Raydium CPMM and Burn & Earn, SPL Token-2022, Metaplex), wallets, and phishing or social engineering. Report those to their own teams.
What happens next
We'll confirm we received your report, keep you posted while it's fixed, and credit you when it's published, if you'd like that.