From 52e2f435d82f45573a55d98409f252eca1009dcd Mon Sep 17 00:00:00 2001 From: aljo242 Date: Thu, 1 Oct 2026 13:57:33 -0400 Subject: [PATCH 1/3] docs: resolve the three open questions left in the patch policy Scope: the monthly private repositories cover every repository in bug bounty scope. The named repositories were reading as the limit rather than as examples, so a team outside the list could not tell whether it was covered. Leaking patch source: passing it on before the patch is public costs a team access to the private repositories and any future invitations. The existing consequences ladder is written for reporters and turns on bounty eligibility, which means nothing to a downstream chain, so it left this rule unenforced on paper. Further action is left open pending the legal position on NDAs. Active exploitation: handled immediately and separately, rather than just "as an incident". --- SECURITY.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 14be176..911c6c0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -91,10 +91,10 @@ disclosure all follow the same path. ### Monthly private repositories Cosmos Labs maintains a set of private repositories each month, one for each -repository in bug bounty scope. Coverage targets the repositories downstream -chains depend on most, including the Cosmos SDK, CometBFT, IBC-Go, Cosmos EVM, -and the CosmWasm repositories. They are named for the repository and the month, -for example `cosmos-sdk-priv-july-2026`. +repository in bug bounty scope. That includes the Cosmos SDK, CometBFT, IBC-Go, +Cosmos EVM and the CosmWasm repositories, and it is not limited to them. They +are named for the repository and the month, for example +`cosmos-sdk-priv-july-2026`. Access is granted to downstream teams that have passed KYC and run the repository in production. Each month's repositories are created fresh and @@ -120,6 +120,11 @@ is public, do not publish it in a public repository, do not commit it to one inside a vendored dependency tree, and do not make it available to validators or node operators. +A team that passes patch source on before the patch is public loses access to +the private repositories, including the invitations to any future ones. We may +also take further action where the disclosure put chains at risk. This is a +serious violation of secure disclosure and puts all other chains at risk. + Distributing a built binary that contains the patch is allowed, through whatever mechanism the chain already uses, including GitHub release artifacts, provided no patch source is included. @@ -177,9 +182,10 @@ a critical landing in a private repository and its public release. A vulnerability that is being actively exploited, or where we confirm attacker awareness ahead of the scheduled release, leaves the monthly cycle and is -handled as an incident. That means emergency mitigations, private fix -distribution, or a coordinated upgrade, ahead of any public disclosure. This -applies regardless of the original severity classification. +handled immediately and separately as an incident. That means emergency +mitigations, private fix distribution, or a coordinated upgrade, ahead of any +public disclosure. This applies regardless of the original severity +classification. ------------------------------------------------------------------------ From 72eaf1d049971d1176076f5b411dc4057b962868 Mon Sep 17 00:00:00 2001 From: aljo242 Date: Thu, 1 Oct 2026 14:03:53 -0400 Subject: [PATCH 2/3] docs: separate withdrawing access from the disclosure consequences The access rule and the consequences ladder gave different answers for the same first offence. The ladder treats publishing something an attacker can act on immediately as a 3-month suspension; the access rule is permanent. They are not competing, because they are not the same kind of thing. The ladder penalises publishing vulnerability details ahead of a disclosure date, and its levers are bounty eligibility and list membership. Withdrawing access ends a grant that was conditional on the source staying private. Says so, so neither has to take precedence over the other. Also says who the source must not be passed to, since two teams that both have access coordinating on a fix were inside the old wording. --- SECURITY.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 911c6c0..0dca9af 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -120,10 +120,16 @@ is public, do not publish it in a public repository, do not commit it to one inside a vendored dependency tree, and do not make it available to validators or node operators. -A team that passes patch source on before the patch is public loses access to -the private repositories, including the invitations to any future ones. We may -also take further action where the disclosure put chains at risk. This is a -serious violation of secure disclosure and puts all other chains at risk. +A team that passes patch source on, to anyone outside the teams that already +have access, before the patch is public loses access to the private +repositories, including the invitations to any future ones. This is a serious +violation of secure disclosure and puts all other chains at risk. + +That is not a penalty under Consequences of Improper Disclosure below. Access to +the private repositories is granted on the condition that the source stays +private, so breaking that condition ends the grant. Those consequences may apply +as well, and we may take further action where the disclosure put chains at +risk. Distributing a built binary that contains the patch is allowed, through whatever mechanism the chain already uses, including GitHub release artifacts, provided no From 6f96d9a567c1d129a596a9019ac9f6c6154afb65 Mon Sep 17 00:00:00 2001 From: aljo242 Date: Thu, 1 Oct 2026 14:22:05 -0400 Subject: [PATCH 3/3] docs: tighten the access-withdrawal wording Drops a stranded "on" that pushed the subject three clauses from its verb, makes the cross-reference a real anchor link rather than a bare "below" that survives the docs sync as plain text, and fixes a loose antecedent in the scope sentence. --- SECURITY.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0dca9af..f922e8f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -92,7 +92,7 @@ disclosure all follow the same path. Cosmos Labs maintains a set of private repositories each month, one for each repository in bug bounty scope. That includes the Cosmos SDK, CometBFT, IBC-Go, -Cosmos EVM and the CosmWasm repositories, and it is not limited to them. They +Cosmos EVM and the CosmWasm repositories, and is not limited to them. They are named for the repository and the month, for example `cosmos-sdk-priv-july-2026`. @@ -120,15 +120,16 @@ is public, do not publish it in a public repository, do not commit it to one inside a vendored dependency tree, and do not make it available to validators or node operators. -A team that passes patch source on, to anyone outside the teams that already -have access, before the patch is public loses access to the private -repositories, including the invitations to any future ones. This is a serious -violation of secure disclosure and puts all other chains at risk. +A team that passes patch source to anyone outside the teams that already have +access, before the patch is public, loses access to the private repositories, +including the invitations to any future ones. This is a serious violation of +secure disclosure and puts all other chains at risk. -That is not a penalty under Consequences of Improper Disclosure below. Access to -the private repositories is granted on the condition that the source stays -private, so breaking that condition ends the grant. Those consequences may apply -as well, and we may take further action where the disclosure put chains at +That is not a penalty under +[Consequences of Improper Disclosure](#consequences-of-improper-disclosure). +Access to the private repositories is granted on the condition that the source +stays private, so breaking that condition ends the grant. Those consequences may +apply as well, and we may take further action where the disclosure put chains at risk. Distributing a built binary that contains the patch is allowed, through whatever