Security policy

If you think you've found a security problem in MLKY, we want to hear about it, and we want to fix it before anyone can use it against people's cards or money.

How to report

Email security@mlky.io. Please don't post about it or share it with anyone else until it's fixed.

Tell us:

• which part of MLKY it affects
• what someone could do with it
• how to reproduce it, step by step
• whether you'd like to be credited, and under what name

What's covered

• the MLKY smart contract on Solana
• the app at mlky.io and the services behind it

If the problem is in software from another team that MLKY relies on, report it to them as well, and tell us too.

What we ask of you

• Only test with cards and wallets you own, and stop as soon as you've confirmed the problem.
• Don't access, change or move anyone else's cards, money or data.
• Don't do anything that could slow MLKY down or take it offline for other people.
• Give us a reasonable amount of time to ship a fix before you tell anyone else.

What you can expect from us

• We reply within 48 hours to confirm we've received your report.
• We keep you updated while we look into it and fix it.
• We tell you when the fix is live, and agree with you on when it can be made public.
• If you've acted in good faith and followed this policy, we won't take legal action against you for looking.

This policy is also published as a security.txt file and inside the MLKY smart contract itself.