The CrossChain KYC Bridge (CCKB) project prioritizes security and user privacy. This document outlines our security practices and how to report vulnerabilities.

• Smart Contract Audits: We recommend using a reputable security auditing firm to assess the smart contracts for vulnerabilities before deployment in a production environment.
• Open Source Development: Open-source development allows for community review and identification of potential security flaws.
• Decentralized Storage: Sensitive KYC data is stored as hashed representations in decentralized storage solutions (IPFS, Arweave) minimizing the attack surface.
• Zero-Knowledge Proofs (Optional): When enabled, ZKPs minimize data exposure by revealing only specific attributes verified by the KYC provider.
• Access Control Mechanisms: Granular access controls ensure only authorized entities can access specific data upon user consent and following relevant legal frameworks.
• Regular Dependency Updates: We strive to keep all dependencies updated to address known vulnerabilities in external libraries.
• Reporting Vulnerabilities: We encourage responsible disclosure of security vulnerabilities. If you discover a vulnerability, please report it privately to us at [email protected].

• A detailed description of the vulnerability, including steps to reproduce it.
• The potential impact of the vulnerability.
• (Optional) A patch or suggestion for fixing the vulnerability.

We will:

• Acknowledge your report within 72 hours.
• Work with you to verify and understand the vulnerability.
• Develop a fix and release a patch as soon as possible, depending on the severity of the vulnerability.
• Publicly acknowledge your contribution after the fix is released, with your permission.

We will not:

• Share your report with any third party without your permission.
• Retaliate against you for reporting a vulnerability in good faith.

This security policy is subject to change. We encourage you to periodically review this document for updates. The use of CCKB is at your own risk. We make no guarantees regarding the security of the platform, especially for deployments outside of a controlled environment.

Secure Smart Contract Programming: https://consensys.io/blog/the-smart-contract-security-mindset
Decentralized Storage Security: https://security.filecoin.io/
Zero-Knowledge Proofs Security: https://ethereum.org/en/zero-knowledge-proofs/

We appreciate your help in keeping CCKB secure!