// Legal

Security & Disclosure

Last updated: October 15, 2026

← BACK TO HOME

Reporting vulnerabilities

If you find a security issue, email security@trench.club with details and steps to reproduce. Please do not publicly disclose before a reasonable fix window.

Scope

In scope: main website, API routes, card generator, and OECD notifiers. Out of scope: third‑party services (Helius, Upstash, Vercel, DexScreener) unless the issue is in how we integrate them.

No bug bounty (yet)

There is currently no paid bounty program. Reports are appreciated and can earn early‑access recognition.

Response time

We aim to acknowledge reports within 72 hours and fix critical issues within 14 days.

Questions? Email security@trench.club.