Security Policy — Ninja No Jutsu

Reporting a Vulnerability

DO NOT open a public GitHub issue to report a security vulnerability. Public issues disclose the vulnerability before it can be fixed, putting users at risk.

Instead, please report vulnerabilities privately using one of the following methods:

  1. Email: Send a detailed report to code@ninjanojutsu.com. For sensitive reports, please encrypt your message using our PGP key (available at https://ninjanojutsu.com/pgp-key.asc).

  2. GitHub Private Report: Use GitHub's "Report a Vulnerability" feature on our repository ( https://github.com/NinjaNoJutsu/dojutsu-escrow/security/advisories/new).

What to Include

  • A clear description of the vulnerability.
  • Steps to reproduce the issue (proof-of-concept).
  • Potential impact and affected versions.
  • Your contact information (optional, but helpful for follow-up).

What to Expect

  • Acknowledgment: We will acknowledge receipt of your report within 48 hours.
  • Investigation: We will investigate and validate the issue.
  • Remediation: We will work on a fix and coordinate a responsible disclosure timeline.
  • Public Disclosure: Once the fix is deployed, we will publicly acknowledge your contribution (unless you prefer to remain anonymous).

Scope

  • Smart contract code in the dojutsu-escrow repository.
  • On-chain program logic and account validation.
  • Configuration and deployment scripts.

Out of Scope

  • Third-party dependencies (report them to their respective maintainers).
  • Frontend or website issues (unless they directly affect the smart contract).
  • Social engineering or phishing attacks.

Bug Bounties

At this time, we do not offer a formal bug bounty program. However, we are grateful to security researchers who help us improve the security of the protocol. We will publicly acknowledge all valid reports on our acknowledgments page, unless you request to remain anonymous.

Supported Versions

Version

Supported

Latest (main branch)

Older releases

✅

❌

We recommend always using the latest deployed version.

Contact

PGP Public Key (ASCII Armor)
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGpROKwBEADr1S5i+iVXJ64JwrSok04JCBtuFxM/8aOH/JbMYKlMkEM9QHbc
lP42zokkfMUWrlCGTHvd5HdEUQtfgrbatx27w/ytNK9IqGhG2NZeU+TRIbZ83hpH
0AiwP66iqq2rVo0yJ5qnaM3QU+FbLDiNc1RsHYBT5KRlVT330A1bU/arFCnVbuIV
kpWI/qlGNDXRDRD+vhnJ0Thu5IX+GTBATLY7LLyY/n14JmQJQitNSKw73ej1zQC0
L2rCMeS4MtCmDkJ6gdTXIAtWoPRhC/DySLsY8wMAchDyIx05LricyAp/XQLmMcgz
JYKz0JuGGLZKV02tnkJnAsIt3fZQffIoBcR/cQrROgLki/vZ9pXDE846xGrSO63o
5a8WeOsdBEeSquYfDF5i4DFyMt0cLxBL3fXSl/SJ7Cyhl/YZkoiU2hwC+WPx66Co
Asb3klxswHJPvy8G7C6O7UZHFzaUAkMDuxetkK8GhDMabfb9XpQBvlExVyc/Bnzw
IfwLF120PD/4tzS2651iCR2fcJ9CPJreINoS4WXZz6+bwApkQTOk+dUrZpwLpxnU
JrOsM5a74NOSk9KWGRYdkAZ6DZEgjHuH/3jy9q1MDfFrlDIL7fw68jzFrSPIdpZX
+daP2REUz/BRrkKF0dgWII23tqIqc+8u0+pfR8AyUYkEc3les6AUsmrScQARAQAB
tC1jb2RlQG5pbmphbm9qdXRzdS5jb20gPGNvZGVAbmluamFub2p1dHN1LmNvbT6J
Ak4EEwEKADgWIQTC9OG+/m7axg+UiZFsRoX9sF3bhgUCalE4rAIbAwULCQgHAgYV
CgkICwIEFgIDAQIeAQIXgAAKCRBsRoX9sF3bhiPiD/4i8tzJSeqlGFXGH6+2SIX1
sDiJL/BXh7djAQ+7ruQdfeWIq454JXSY32rI75+v7q3i9wQ2afRmBrAK7euS2HVI
8Fsg0TZL/w9P57hiBsOaIdh4I3xgM7BPRkV+UF1CmPpzFWVaysWbU1XXDR5h43NH
udA/1UrPeMwrLdpkOBQ5A0jSkhyqwxHgR2cdL5+6GFU7kpvAfcYGYlWz/k+6Rci9
8AyPyHz5ECw+uo/gY2MtV7Mwk5vKG5z8JSlJJRPjSUVLjMWOH38erxCEqs0b57ud
w1S8f7Nry3xTKv7I13eeudvj0jV3XcQhtQ2MPyGQMMrezJttNDkPrZwK5YKIj9zS
tJx7ZuKPc1MorC5x2toQHPmQM3HKvxsXHXGiLEidVMxgAYQQAJpuzIzLoyzwVyse
qmEnsxtUh/mYdZ45VsuhHNlta+OQfmK79vAis6gDTKYLXsx3QnaQj7bKlJcNRmnD
5Z6pVh0Wr9hww/Wv3L/BPoNo4OxG4FOqAA5iSEkiG2izTZun8AZR/4gbptbFIGwR
HxuDV3VHLTWGiVh1Vg57iqqhFSVGW853WkXnrnp/t1P39+dvQ8d2c/kiMN79dtF5
QQTUy/pDtDrsc3nP+otUv+d+uWYqL1jkfSD1EtzvdUft2+KTvFd2B7JPEz4sqx/y
jOK6QoFOg2Ts2CZUKB5H5bkCDQRqUTisARAAzMWUCIibigDo2g9vU4GEMEtWSdYW
ruFA5RWGE5jciDknEJiaAYtrOBNtNjech0RUgoVknQrQccS0fJdGQiSjeJmfvDOH
xvO8kHmwyZxPKlFJjOYFNRIG3WzvPwd9f0L0lEPjObxdJGY0SLJW5lKSF/IcgUuz
6kq3yPAlg2vXkxshWXsyWrbFBddQuj/tl9UgE20/yHD/Yim0VlS/uzE4q1xFSgd3
sXsOmm1rf3pnJMeTBVjjTc9K2UKSFJQ3osWEu/YmFa57AgMwHZD54SUpSlE1jbLw
fEhNGT3RtqksnyoUwh9SIzoTXQ1xmN7EWqUC8NHqb3Qhkua4hGquuzZf+R3w6urL
45jqQw0FhEIjrcm0abOgaI/CaZ/acrYuun5MgMOR8QdOErdSHLtZQOJ0AeKTPnTo
DcmevobcaJS/jLG56F96Ua0shomNGjnaslORBMuVnZx+pGcUDDgWxUStErpr3buO
Ul7WLQX77WvApZj6QIjp82KTmaT0hwarOydcJHKqnJaD4oiDzoWjC/QZPwXfM+QD
Bx0+r2AASCWf063mc6aKZESijN5umHSWEFWVk1F9ZRQvPZ7yldox8Sn6K593OZWY
ovXv4gwybCG+AGbU8C+AEFVU74xVTT2CzUDDumZCbst0MTYu+8cuJuUMqihOIoGs
C4ypvsBxgbZ/zJMAEQEAAYkCNgQYAQoAIBYhBML04b7+btrGD5SJkWxGhf2wXduG
BQJqUTisAhsMAAoJEGxGhf2wXduGgR0P+wfB6jFTP+Ob/Q8iUDBGueL2kiZTh333
etiLjA7XLfanIszHykkj2/hXB4ORuG+0jy1F03oJleq4souG3GV/BAhENtPsY4E8
3QFOod+CDPUq3lhBXISRkTA5kaspXFogYs7rONSTMTCnKU17myZ1B4rtL6GKRryL
UbcMO341F1+rzfllg9qiBOZ+3nDBtD6iaWnkK0IECE4rgOF02A8ZKP8+OLUWL4ae
9Y3zsSnhJ1AtJ4AtnWCkVmddQjtReiYcp+vYfPH0JrL341By5Y7JO6/CotiyKCry
wr67DIyEiingw7RyHzPxDNPi2EWXbmFWrJyT5Eu+R+P1Ymhjju9TiCRSinbmDDq9
jQ9KB7RetsjSv7LUrtMoK0NMDZe+TT6h0YW9I01wuQkrvSJrK/9xbSF2WJIAjF04
zM/qmccN3TWPv/LbmrShEbx/mcz7tRpgGUQ0DmZgCe3xxBzr38sBcI+n/dc0SBZe
FeYq/9cw81OEQHnk1sM0gVGg0tPlGlTDV0perqxUFJ4hK7qxZ7jX8IKVB2VavMlR
EqjOQp6rbiSTp9TyjgST016TUJibs+EdhGSDq3gDj5gzsMRGpN3ouvee1HAodo5i
6kt9M9BCDYcP0Wf9aW2CDGeE89Z59Da/mOHtSidfGl12JCFiY3yJ/ljxiMRiuorE
wcoG3IFyxP81
=D5kJ
-----END PGP PUBLIC KEY BLOCK-----

Last updated: 2026-07-10