OnchainTA is committed to high security standards for its digital transfer agent platform and the tokenized securities services it supports. We appreciate security researchers who identify and responsibly report potential vulnerabilities and help protect issuers, investors and our ecosystem.
Safe Harbor
OnchainTA will not pursue legal action against researchers who discover and report vulnerabilities affecting onchainta.com or OnchainTA-controlled services in good faith and in accordance with this policy. We consider research conducted within the scope and rules below to be authorized conduct.
This commitment applies only to actions OnchainTA can legally authorize. It does not authorize activity involving third-party systems, networks, accounts, assets or data, and does not bind third parties. If you encounter sensitive information or a potentially harmful vulnerability, stop testing and report it promptly.
Scope
This policy covers security research on onchainta.com and its subdomains operated by OnchainTA, including related applications and APIs, to the extent testing complies with this policy.
Third-party providers, blockchain networks, custodians, external wallets, customer-operated systems and other services outside OnchainTA's control are not covered by this safe harbor. Do not treat publicly accessible endpoints, smart contracts or third-party integrations as authorized targets for disruptive or transactional testing. If you are unsure whether a system or activity is in scope, email security@onchainta.com before proceeding.
Research Guidelines
To remain eligible for safe harbor, do not:
- Disrupt service. No denial-of-service, flooding, load or stress testing without prior written authorization.
- Use social engineering. No phishing, impersonation or deceptive communications targeting OnchainTA employees, providers, customers or users.
- Test physical security. No attempts to access offices, data centers or hardware.
- Access others' data. Do not access, copy, disclose, modify or delete personal information, KYC records, credentials or documents that are not yours. If such data becomes visible unintentionally, stop and report it without retaining or sharing it.
- Cross account boundaries. Use only your own accounts and assets, or test accounts you are expressly authorized to use.
- Transact. Do not change securities, token balances, wallet balances or funds. Contact security@onchainta.com before any testing that would involve a transaction, and never execute irreversible production blockchain transactions as proof of a vulnerability.
- Cause lasting harm. No malware, ransomware, backdoors, persistent access or changes to production configurations or data.
- Disclose early. Do not publish details before coordinating disclosure with OnchainTA and allowing a reasonable opportunity to investigate and fix the issue.
Use the minimum testing needed to demonstrate a vulnerability, and submit a non-destructive proof of concept where possible.
How to Report
Email security@onchainta.com with as much of the following as you can safely provide:
- A description of the vulnerability and its potential impact.
- The affected URL, application, API or component.
- Reproduction steps or a minimal, non-destructive proof of concept.
- The conditions or permissions needed to reproduce it.
- Relevant timestamps, request identifiers or redacted screenshots.
- How to contact you, and the name you'd like used for recognition, if any.
Do not email passwords, private keys, unredacted identity documents, complete KYC records or other sensitive personal information. If you need to share sensitive evidence, contact us first to agree on a secure method.
Response Timelines
We aim to acknowledge your report within 2–3 business days and to give regular updates during investigation and remediation. Resolution time depends on severity and complexity. We may ask for more information or agree a disclosure date with you; please allow a reasonable opportunity to fix confirmed issues before publishing details.
Recognition
OnchainTA does not offer financial bug bounties at this time. With your consent, reports that lead to a fix may be recognized in our Security Hall of Fame.
Contact
Report security vulnerabilities to security@onchainta.com. Use this address only for security reports; for account and service questions, contact support@onchainta.com.
This policy supports responsible vulnerability disclosure and does not grant permission to violate applicable law or the rights of others. OnchainTA may update it as its services and security practices evolve.