If you have found a vulnerability in anything we publish — this site, the deployed contracts, the SDKs or the services behind them — tell us before you tell anyone else, and we will work with you on it. This page is the one place that says how.
Email security@unibase.com. It is also published, with this page, at /.well-known/security.txt under RFC 9116, so an automated check finds the same address.
A report is most useful when it contains the affected URL, contract address or package; what an attacker gets out of it; and enough detail to reproduce it — the request, the transaction, the snippet. If a proof of concept is easier to send than to describe, send it. Write in English or Chinese, whichever you prefer.
Please report privately and give us a chance to fix the issue before writing about it publicly. We do not run a paid bug bounty; if that ever changes it will be described on this page, so treat an offer made anywhere else as not ours.
Three things, and they are all things you can inspect:
Some things are predictably not useful: reports against third-party services we merely link to, findings produced by a scanner with no demonstrated impact, missing headers or best-practice warnings on their own, and anything whose proof requires degrading the service for other people. Please do not run denial-of-service tests, do not touch accounts or data that are not yours, and do not social-engineer anyone. If a test would need one of those to prove the point, describe it instead and we will reproduce it ourselves.
The address goes to engineers who can act on what you send, not to a ticket queue. We will confirm that the report arrived, tell you what we concluded — including when we decide something is not a vulnerability, and why — and let you know when a fix ships.
We would rather say this plainly than publish a number we cannot keep: there is no guaranteed response time here. A report that can move funds is looked at first. If you have heard nothing and think your report was missed, reply to your own email and say so.
Where a fix is user-visible it goes in the changelog. If you want to be credited for a report, say so and we will name you; if you would rather not be, we will not.
The UB token contract was audited by PeckShield, and the report is published in full rather than summarised — the findings, their severity and what was done about each one. The deployed addresses it applies to are on the token page, across Ethereum, BNB Smart Chain and Base.
The protocols, SDKs and contracts are public on GitHub, and how the pieces fit together is in the documentation. Reading them is the fastest way to tell whether something you have found is a bug or a design decision — and if the documentation is what is wrong, that is worth an email too. Who we are and how to reach us otherwise is on the about page.
Machine-readable version: https://unibase.com/.well-known/security.txt