Report suspected vulnerabilities through the Cosmos disclosure process: https://github.com/cosmos/security/blob/main/SECURITY.md

Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Reward ranges and in-scope impacts are maintained on the Cosmos Immunefi program page: https://immunefi.com/bug-bounty/cosmos/scope/

Supported components are the ones listed in the current release family: https://docs.cosmos.network/sdk/latest/release-family

Repositories outside that list, including archived repositories, are not in scope.