> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rekt.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Report a security issue

> How to report a vulnerability in Knockout or Minute, what to send, what we ask of you, and how rewards work.

**If you find a security issue, tell us before you tell anyone else.** Send it to
**[support@asymmetra.xyz](mailto:support@asymmetra.xyz)** with the subject line `Security report`.

Reports of any kind are welcome. Good-faith research is welcome.

## What to send

* What the issue is, and what an attacker could do with it.
* Where it is: the program and instruction, the SDK function, the page or the endpoint.
* The steps to reproduce it. A run on a local validator or a mainnet fork is the best proof.
* Your contact, and the name to credit if you want credit.

## What we ask

* Report privately, and give us reasonable time to fix the issue before you publish.
* Prove the issue with the least harm. Use your own funds and the smallest stake. Do not take or
  move funds that are not yours.
* Do not run a denial-of-service or spam test against the live programs, the price service or the
  apps.
* Do not use social engineering against our team, our users or our providers.
* Do not read, change or keep other people's data.

## What we do

* We confirm that we have your report within three business days.
* We tell you what we found and what we will do about it.
* We credit you when the fix is public, if you want that.
* We will not take action against research that follows this page.

## Rewards

**Rewards are at our discretion, and they depend on how critical the finding is.**

The findings we care about most are the ones that put trader funds or pool funds at risk, or that let
someone stop trading or settlement. A finding of that kind is the kind that earns a reward.

Lower-severity findings are still welcome, and we fix them. They do not usually earn a reward. That
includes ordinary website issues, SDK bugs that put no funds at risk, and best-practice suggestions.

There is no fixed table of amounts.

## Scope

| In scope | Where |
| - | - |
| The Knockout program | `1oooxLtzLiYV6LcDybrEPcyXVLPWGnAmeif9s5oNrp6` on Solana mainnet |
| The Minute program | `MinXAXaPZezFMc8mm1uZnK8NcYt7Fhbr7Eifdnw7cfH` on Solana mainnet |
| The public data API | `data.rekt.trading` |
| The apps | Anywhere they build or send a transaction for these programs |

Not in scope:

* Services we do not run: wallets, RPC providers, exchanges and the Solana network.
* Anything that needs the victim's own device or key to be compromised first.
* Limits that are already stated on the [risk](/risk) page.

<Note>
  Knockout and Minute are early alpha software and have not been audited by a third party. Read the
  [risk](/risk) page before you trade.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.