Report a vulnerability

1. Report privately

Contact a verified Poolz Pad administrator through the official Telegram community and ask to continue in a private reporting channel. Do not post vulnerability details in a public group or contact community members through unsolicited direct messages.

2. What to include

Start with a plain-text description of the affected page, contract, address, or function; the potential impact; clear reproduction steps; and the relevant network and transaction hash where applicable. Include the minimum proof needed for us to validate the issue and a safe way to contact you.

3. Safe testing rules

Do not access or change another person’s data, move funds, disrupt services, attempt denial of service, publish the issue before it is resolved, or continue testing after demonstrating the problem. Never request a seed phrase, private key, wallet connection, token approval, transaction, or message signature from a team member.

Do not send executables or require the team to open unknown links or files. We may ask for evidence in a controlled format or reproduce the issue independently.

4. Scope

Reports should relate to poolzpad.com, official Poolz Pad deployments, POOLZ-owned repositories, or contract addresses published through official POOLZ channels. Third-party services, social engineering, spam, denial-of-service activity, and automated scan output without a demonstrated security impact are outside scope.

5. Review and rewards

We will acknowledge credible reports, validate them, and coordinate remediation where required. Submission does not create an entitlement to payment. No bounty, reward, or other compensation is promised unless it is agreed in writing by an authorised Poolz Pad representative.