Home/SOKEN Contract Review/Responsible Disclosure

Responsible Disclosure Policy

Last updated: 24 October 2026

We take the security of the SOKEN Contract Review service (the "Service") and its infrastructure seriously. This policy describes how to report security vulnerabilities to us and what you can expect in return.

1. Scope

The following systems and assets are in scope for security reports:

  • The MCP server at mcp.soken.dev
  • The hosted Report pages at soken.dev/r/*
  • The upload endpoint at soken.dev/u/*
  • The verification and management pages on soken.dev
  • The public source repositories associated with the Service

2. Out of Scope

The following are out of scope and should not be reported to us:

  • Vulnerabilities in third-party smart contracts. The Service reviews smart contract code. Vulnerabilities found in the contracts themselves should be reported to the contract owner or operator, not to SOKEN LTD.
  • Inaccuracies in Report findings. Reports are the automated output of the Requester's own AI client session, not statements by SOKEN LTD. If a Report contains materially inaccurate findings, see our Report Removal Policy.
  • Third-party services and infrastructure not operated by SOKEN LTD.
  • Social engineering attacks against SOKEN LTD personnel.
  • Denial-of-service attacks (testing or demonstrating such attacks is prohibited).

3. Rules of Engagement

When conducting security research on in-scope systems, you must:

  1. act in good faith and in compliance with applicable law;
  2. not access, modify, delete or exfiltrate data belonging to other users of the Service;
  3. not degrade the availability or performance of the Service for other users;
  4. stop testing and report the issue promptly if you encounter personal data or sensitive information belonging to others;
  5. not publicly disclose the vulnerability before we have had a reasonable opportunity to assess and address it;
  6. not use the vulnerability for any purpose other than demonstrating it to us in your report; and
  7. report the issue to us before sharing it with any other party.

4. How to Report a Vulnerability

Please send your report by email to hello@soken.dev.

Your report should include, where possible:

  • a clear description of the vulnerability and its potential impact;
  • the affected component (for example: the MCP server, hosted pages, upload endpoint, or a specific repository);
  • detailed steps to reproduce the vulnerability, or a proof of concept;
  • any tools, scripts or configurations used in your testing; and
  • your contact details so that we may follow up with questions.

Our contact details for security reports are also published in machine-readable form at mcp.soken.dev/.well-known/security.txt.

5. Our Commitments

When you report a vulnerability in accordance with this policy, we will:

  1. acknowledge receipt of your report within 3 business days;
  2. provide an initial triage assessment within 7 business days;
  3. keep you informed of our progress in assessing and addressing the vulnerability;
  4. credit you as the reporter (if you wish) when we disclose the fix, unless you request anonymity; and
  5. not pursue legal action against you for research conducted in compliance with this policy (see section 6).

The timelines above are targets, not guarantees. Complex issues may require additional time. We will let you know if we need more time and provide updates as our investigation progresses.

6. Safe Harbour

If you make a good-faith effort to discover and report a security vulnerability in the systems listed in section 1, and you comply with the rules of engagement set out in section 3, we consider your research to be:

  • authorised with respect to any applicable anti-hacking laws, and we will not initiate or support legal action against you for your research;
  • authorised with respect to any applicable anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls; and
  • exempt from restrictions in our Terms of Use that would otherwise prohibit the security testing activity, provided it is conducted solely for the purpose of responsible disclosure.

This safe harbour does not extend to actions that cause harm to users, compromise the availability of the Service, or involve access to data belonging to other users.

7. Bounty Programme

SOKEN LTD does not currently operate a paid bug bounty programme. We may choose to offer a reward at our discretion for particularly significant or well-documented reports, but no reward should be expected. If a bounty programme is established in the future, it will be announced on this page.

8. Contact

Security reports: hello@soken.dev

Chat