# Security policy > How to report a vulnerability in Inferit: contact, scope and safe harbour for good-faith research. We welcome reports of vulnerabilities in Inferit. This page says how to reach us, what is in scope and how we treat good-faith research. - **Updated**: 2026-10-06 - **Network**: Whitechain Sepolia ยท testnet - **Report to**: [GitHub private vulnerability reporting](https://github.com/OGcryptonaut/whitechain-x402-facilitator/security) - **First reply**: We aim to acknowledge within three business days. - **Disclosure**: Once a fix is live, or after 90 days. No public issue before then, please. - **Bounty**: No paid bug bounty at this stage. - **Contracts**: MarketEscrow and TestCredit on Whitechain Sepolia, a test network. Not audited. - **Safe harbour**: Good-faith research that follows this policy is authorised ([details](https://inferit.cc/security.md#safe-harbor)). ## How to report Report privately via [GitHub private vulnerability reporting](https://github.com/OGcryptonaut/whitechain-x402-facilitator/security). Include what you found, the affected component and address or URL, steps to reproduce and the impact you expect. Please do not open a public issue or post details before we have had a reasonable chance to fix the problem (we suggest 90 days, or sooner once a fix is live). On GitHub, the Report a vulnerability button opens a private advisory that only the maintainers can read (you need a GitHub account). The repository is whitechain-x402-facilitator, the open-source companion project maintained by the same team; reports about any part of Inferit are welcome there. We aim to acknowledge reports within three business days. There is no paid bug bounty at this stage. ## Scope In scope - The MarketEscrow and TestCredit contracts on Whitechain Sepolia (addresses on the [Whitechain escrow](https://inferit.cc/docs/payments/whitechain.md#live) page), especially any way to move funds outside the bounds described in [Security & trust](https://inferit.cc/docs/security-trust.md#custody). - The Inferit API: authentication, API keys, sessions, routing, metering and settlement. - The x402 facilitator and the sponsored testnet ITC faucet ([Pay per request with x402](https://inferit.cc/agents.md)): any way to be served without paying, to replay or redirect a payment, to credit a payment to anyone but its signer, or to make the facilitator key spend gas on payments that never verify. - This website, including the wallet flows and what the site asks your wallet to sign. - The seller-node sidecar (`apps/seller-node`), and anything that would let one party learn what the API promises not to publish. Out of scope - Third-party services: the Whitechain network, RPC, [explorer](https://explorer.testnet.whitechain.io) and WBT faucet, wallets, and our hosting providers. Report those to their operators. - Denial of service, volumetric or load testing, and spam. - Social engineering, phishing or physical attacks against people. - Issues that need a compromised device or browser, or that only affect outdated browsers. - Missing headers or best-practice notes without a demonstrated impact. - The fact that settlement data is public on-chain; that is by design. ## Safe harbour If you research in good faith and follow this policy, we consider your research authorised, will not pursue or support legal action against you for it, and will work with you to understand and fix the issue. Good faith means you: - use only testnet tokens and accounts and wallets you control; - do not access, change or keep other people's data beyond the minimum needed to show the issue; - do not degrade the service for others, and stop and tell us if you reach data that is not yours; - give us reasonable time to fix the issue before disclosing it. If in doubt about whether something is allowed, ask first. ## Custody and trust What the MarketEscrow contract is designed to enforce, what is policy and what we do not verify yet are set out in [Security & trust](https://inferit.cc/docs/security-trust.md). The live values (the owner Safe and its signers, the guardian and the operator) are read from the contract on the [Whitechain escrow](https://inferit.cc/docs/payments/whitechain.md#live) page. --- Canonical page: https://inferit.cc/security All pages as markdown: https://inferit.cc/llms.txt Testnet demo: test tokens, no monetary value.