Report a security issue.
If you find a weakness in our sites, APIs, packages or contracts, tell us privately before anyone else.
How to report
- Write to
- hello@rearclabs.com, with the subject “Security”.
- Include
- What you found, where it is (a URL, an API endpoint, or a package and its version), the steps to reproduce it, and what it would let someone do.
- Language
- English or Turkish.
What it covers
- rearclabs.com
- This website and its machine-readable files.
- ARES Protocol
- ares-protocol.xyz (now a status page; ARES is paused) and the unmaintained testnet contracts on Base Sepolia: the registry and the ARI engine.
- Bilinc
- bilinc.space, the MCP server at mcp.bilinc.space, and the bilinc package on PyPI.
- Clawifi
- clawifi.dev, the API at api.clawifi.dev, the clawifi package on PyPI and the clawifi-mcp repository.
- Not ours
- Services other companies run, such as GitHub, PyPI or the Base network. Please report those to their owners.
While you test
- Disclosure
- Give us reasonable time to fix an issue before you publish anything about it.
- Your own data
- Use only accounts and data that are yours. Don’t access, change or keep anyone else’s data; if you reach some, stop and tell us.
- No harm
- No denial of service, spam, social engineering or physical attacks.
- Scanning
- No automated scanning that slows the services down or degrades them for other people.
What happens next
- We confirm
- We write back to say we have your report.
- We fix it
- We keep you posted while we work on a fix, and ask if we need more detail.
- We tell you
- We let you know when the fix is out.
- Bounty
- There is no paid bug bounty.
Machine-readable
- security.txt/.well-known/security.txt
The same contact in the standard format (RFC 9116), for tools and scanners.