Report suspected vulnerabilities through the Cosmos disclosure process: https://github.com/cosmos/security/blob/main/SECURITY.md
Do not open a public issue, pull request, or discussion for a suspected vulnerability.
Reward ranges and in-scope impacts are maintained on the Cosmos Immunefi program page: https://immunefi.com/bug-bounty/cosmos/scope/
Supported components are the ones listed in the current release family: https://docs.cosmos.network/sdk/latest/release-family
Repositories outside that list, including archived repositories, are not in scope.