Security & Responsible Disclosure
Last updated 1 October 2026
Pre-launch notice. Muny is currently in test mode on Solana devnet, where tokens have no monetary value. The legal entity that operates Muny, its registered address and the governing law will be added here before Muny processes real-value transactions. Until then, “Muny”, “we” and “us” mean the operator of Muny, reachable at legal@muny.io.
We welcome reports from security researchers. If you believe you've found a vulnerability in Muny, please tell us privately at security@muny.io so we can fix it before it's exploited.
In scope#
- muny.io (website, dashboard, hosted checkout) and api.muny.io
- The Muny Wallet app
- Muny's official SDKs (JavaScript/TypeScript, PHP, Python) and the WooCommerce plugin
How to report#
Include a description, the affected URL or component, steps to reproduce, and the impact. We aim to acknowledge reports within 3 business days and keep you updated until the issue is resolved.
Rules#
- Use only accounts you own or test accounts; never access, modify or delete other people's data.
- Don't run denial-of-service, spam, social-engineering or physical attacks.
- Don't move funds you don't own, even on devnet.
- Give us reasonable time (90 days by default) to fix the issue before disclosing it publicly.
Safe harbour#
If you follow this policy in good faith, we won't pursue legal action against you for your research, and we'll work with you to understand and fix the issue. Muny does not currently run a paid bug-bounty programme.
Questions? Email legal@muny.io — or for privacy matters privacy@muny.io.