The Provenance team and community take all security vulnerabilities in Provenance seriously.

Thank you for improving the security of Provenance. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.

Please report security vulnerabilities to security@provenance.io. Please avoid opening a public issue on the repository for security issues.

The Provenance team will send a response indicating the next steps in handling your report. After the initial reply to your report, the team will keep you informed of the progress towards remediation and may ask for additional information or guidance. For critical problems you may encrypt your report using the public key below.

In addition, please include the following information along with your report:

• Your name and affiliation (if any).
• A description of the technical details of the vulnerabilities. It is very important to let us know how we can reproduce your findings.
• An explanation of who can exploit this vulnerability, and what they gain when doing so -- write an attack scenario. This will help us evaluate your report quickly especially if the issue is complex.
• Whether this vulnerability is public or known to third parties. If it is, please provide details.

If you believe that an existing (public) issue is security-related, please send an email to security@provenance.io. The email should include the issue ID and a short description of why it should be handled according to this security policy.

If you have found an issue with the Cosmos SDK or CometBFT modules not found in this repo you can report them through links found here: https://github.com/cometbft/cometbft/blob/main/SECURITY.md.

When the security team receives a security bug report, they will assign it to a primary handler. This person will coordinate the fix and release process, involving the following steps:

• Confirm the problem and determine the affected versions.
• Audit code to find any potential similar problems.
• Prepare fixes for all releases still under maintenance. These fixes will be released as fast as possible to the project.

If you have suggestions on how this process could be improved please submit a pull request or email security@provenance.io