DRAFT: the reporting channel and bug-bounty decision are pending (roadmap H-10, DEC-16).

Kinlock handles other people's money. If you find a vulnerability, do not open a public issue. Report it privately through GitHub's "Report a vulnerability" (private security advisories) on the affected repo.

In scope: the kinlock contract, SDK, indexer, app, and registry tooling. Kinlock runs on testnet only; there are no mainnet funds yet.