# Security Policy
1. [Reporting security problems](#reporting-security-problems-in-rts-alloc)
2. [Security Bug Bounties](#security-bug-bounties)
## Reporting security problems in rts-alloc
**DO NOT CREATE A GITHUB ISSUE** to report a security problem.
Instead please use this [Report a Vulnerability](https://github.com/anza-xyz/rts-alloc/security/advisories/new) link. Provide a helpful title, detailed description of the vulnerability and an exploit proof-of-concept. Speculative submissions without proof-of-concept will be closed with no further consideration.
Proof-of-concept requirements:
- All PoC code must be inlined directly in the advisory as source code
- Do not attach or link to compiled binaries, executable files, or external repositories
- The PoC should be self-contained and reproducible by building from the provided source
- Include the output you observed when running the PoC locally (e.g., crash output, sanitizer report, reproduction steps with observed behavior)
Reports that have not been manually verified, including reports citing non-existent code, describing theoretical vulnerabilities without demonstrated impact, or lacking verifiable execution artifacts, will be closed immediately. Repeated low-quality submissions may result in permanent disqualification.
If you haven't done so already, please **enable two-factor auth** in your GitHub account.
Expect a response as fast as possible in the advisory, typically within 72 hours.
## Security Bug Bounties
This repository is **not** currently part of any bug bounty program. All issues, regardless of severity, are out of scope for bounty payouts. Vulnerability reports are still welcome and appreciated, and will be handled according to the process described in this document.