In scope
The Pulsar API (/api/v1/node/*, /api/v1/pulsar), the reward/verification logic (quorum, canaries, AP accounting), the agents and extension, and the dashboards. Anything that lets a device earn without doing real work, forge a verdict, read another member's data, or drain the reward pool is high priority.
Out of scope
Denial-of-service, spam, social engineering of our staff, and issues that require a rooted/compromised device you already control. Do not test against other people's sites through the network, and never use real customer data.
How to report
Email a clear write-up — steps to reproduce, impact, and a proof of concept — to the contact below. Give us reasonable time to fix before disclosing publicly. Do not exfiltrate data or degrade the service while testing.
Rewards
Valid, original reports earn Astra Points scaled to severity and impact, credited to your account. This is a good-faith program, not a contract; we decide severity, but we aim to be generous and fast. AP are points of participation in the network, not money: they have no price and are not convertible today.
Safe harbour
We will not pursue or support legal action against research that follows this policy in good faith: stays in scope, respects privacy, and reports promptly. If in doubt, ask first.
Report to our contact page · See also how Pulsar works and the participation terms.
What this page answers
- report a vulnerability
- responsible disclosure
- what is in scope
- network security contact
- what is Pulsar security
- how Pulsar security works
- Pulsar security explained
- Pulsar security guide
- how to start with Pulsar security
- Pulsar security reviews
- is Pulsar security worth it
- Pulsar security pricing
- Pulsar security alternatives
- Pulsar security for beginners
- why Pulsar security
- Pulsar security — what you get
