Security
How to report a vulnerability, what is in scope, and how BrainChain limits the damage any single failure can cause.
Reporting a vulnerability
Please report vulnerabilities privately, never in a public issue.
- Use the Report a vulnerability button on the repository's Security tab, or
- email hello@usebrainchain.com with the subject "Security".
We acknowledge reports within 3 business days and send an assessment within 10. The full policy is in SECURITY.md.
How failures are bounded
| If this fails | The damage is limited to |
|---|---|
| Jev answers wrongly with high confidence | One task, which either side can dispute once |
| Jev is unavailable | Delays; open tasks refund at their deadlines |
| The brain key is compromised | Every open task: the key could hire any active worker, including one the attacker stakes, and accept its work. It could also spend the house treasury through house tasks, up to 20 a day. Changes it queues still wait out the timelock, during which the guardian can veto them. The key is rotated through an adopted change. |
| A worker model fails or misbehaves | Its own tasks; it is paid only for accepted work |
| The sequencer stops | Liveness, until the guardian replaces it |
Status
The contracts have not been audited yet and are not deployed to a network holding real value.