The security of INTcoin and its users is our top priority. This post outlines how to report vulnerabilities and what to expect.
Reporting a Vulnerability
If you discover a security issue in INTcoin software, do not open a public issue or forum post. Instead:
Email: security@international-coin.org
Include:
- Description of the vulnerability
- Steps to reproduce
- Affected versions
- Potential impact
- Any suggested fix (optional)
What to Expect
- Acknowledgement within 48 hours
- Assessment of severity and impact within 1 week
- Fix development prioritised based on severity
- Coordinated disclosure — we’ll agree on a disclosure timeline with you
- Credit — with your permission, we’ll credit you in the release notes
Scope
The following are in scope:
- intcoind, intcoin-cli, intcoin-miner, intcoin-wallet, intcoin-qt
- Consensus rules and validation logic
- Cryptographic implementations (signature verification, key derivation, encryption)
- P2P networking and transport security
- RPC interface
- Wallet key management and transaction signing
The following are out of scope:
- The forum (talk.international-coin.org) — report Discourse issues to the Discourse project
- Social engineering attacks
- Denial of service via resource exhaustion (unless novel)
- Issues in third-party dependencies (report upstream, but let us know)
Severity Levels
| Level | Description | Example |
|---|---|---|
| Critical | Consensus failure, remote code execution, key theft | Signature forgery, private key derivation from public key |
| High | Fund loss, network partition, data corruption | Double spend, chain split, wallet corruption |
| Medium | Information disclosure, DoS, privacy leak | Peer IP deanonymisation, mempool timing attack |
| Low | Minor bugs, UI issues, documentation errors | Incorrect error message, cosmetic glitch |
Bug Bounty
We do not currently operate a formal bug bounty programme. However, we recognise and credit all legitimate security reports, and may provide discretionary rewards for critical findings.
PGP Key
For encrypted communication, request our PGP public key by emailing security@international-coin.org with subject line “PGP key request”.