Do not open a public issue for a security problem.
- GitHub — Report a vulnerability under the affected repo's Security tab.
- Email — spacechild@spacechild.love, subject line
SECURITY.
Include the repo and commit, what an attacker gains, and the smallest reproduction you have.
| stage | target |
|---|---|
| Acknowledgement | within 3 business days |
| Initial assessment | within 10 business days |
| Fix or documented mitigation | within 90 days for confirmed issues |
Space Child Labs is a very small team. If you have not heard back inside the acknowledgement window, send a follow-up — it means the first message was missed, not ignored. There is no bug bounty program; we will not pretend otherwise.
In scope:
- Authentication and session flaws in
spacechild-auth— token forgery or replay, refresh-rotation bypass, MFA/TOTP bypass, SSO/PKCE authorization-code interception, cross-subdomain cookie scoping, and any unsoundness in the zero-knowledge-proof path (Poseidon hashing, proof verification, replayable proofs). - Authorization flaws anywhere state changes: the default-deny posture on state-changing API requests, and ownership checks on destructive operations.
- Anything that exposes AI-provider keys, session secrets, or blockchain signing keys — at rest, in logs, in build artifacts, or to a client. Provider keys are AES-256-GCM encrypted at rest and server-held keys sign all chain transactions; a path that leaks either is in scope.
- MCP server authentication — the acting agent identity is derived from the token, never from client arguments. A way to assert another agent's identity is a vulnerability.
- Blockchain publication integrity: forging proof-of-discovery, or publishing on another researcher's behalf.
Out of scope:
- Findings from a fork you modified yourself.
- Missing hardening headers or TLS nits with no demonstrated impact.
- Volumetric denial of service, and social engineering of maintainers.
- Scanner output with no working reproduction.
- Disagreement with the consciousness metrics as a model of consciousness. Geometric state is a defined computation over sensor data; contesting the interpretation is a research conversation, not a vulnerability — open an issue.
Only the latest release of each component receives security fixes.
Please give us 90 days, or until a fix ships, whichever comes first. If something is being actively exploited, say so in the first message and we will drop everything.