[FEATURE] Launch Bug Bounty Program

[ANAVHEOBA]

[FEATURE] Launch Bug Bounty Program

Description

Set up and manage bug bounty program for security researchers.

Scope

• Program rules and scope
• Reward tiers
• Submission process
• Platform setup (Immunefi)

Labels: bounty,security,priority: medium

[jiarongmai]

I can implement this feature. I have experience with similar tasks and can deliver high-quality code. Ready to start immediately!

[ElromEvedElElyon]

Submitted PR #116 implementing the full Bug Bounty Program.

What's included:

1. docs/BUG_BOUNTY_PROGRAM.md (544 lines) -- Comprehensive Immunefi-style program covering:

   • Scope tables for all assets (smart contracts, ZK circuits, SDK, frontend)
   • Severity classifications (Critical/High/Medium/Low/Informational) with ZK-specific examples
   • Reward tiers: $100 - $50,000 USDC via Drips Wave with bonus multipliers
   • Submission process via GitHub Security Advisories (private) and Issue Templates (public)
   • Report template with all required fields
   • Rules of engagement tailored for ZK privacy protocols
   • Response SLA (24h ack, 72h triage, 14-day Critical fix)
   • Legal safe harbor policy
   • Hall of Fame with Diamond/Gold/Silver/Bronze tiers
   • Exclusions, out-of-scope items, and FAQ

2. SECURITY.md -- Standard security policy at project root with reporting channels, timelines, and contributor guidelines

3. .github/ISSUE_TEMPLATE/bug-bounty-report.yml -- Structured GitHub issue form for Medium/Low/Informational vulnerability reports with severity dropdowns, component selection, and mandatory acknowledgements

PR: #116

[HuiNeng6]

Hi! For setting up your bug bounty program, you might want to check out Opire. It integrates with GitHub for streamlined bounty management, and you only pay when someone claims the bounty with a PR. Could be useful for your security researcher workflow.

PS: I'm helping spread the word about this platform. Feel free to ignore if not relevant!