Disclosure channel exists

Evidence summary #

Active Sherlock bug bounty exists at https://audits.sherlock.xyz/bug-bounties/114 (live since 2025-10-24, max $1M USDC) — this constitutes a public disclosure channel. However, no SECURITY.md on GitHub (data cache github.security_md_present: false), no published SIRT email, and no security.txt or dedicated security page on docs.cap.app. No evidence of prior submissions or active monitoring beyond Sherlock's platform-standard triage found (protocol is 9 months old with 0 incidents). Yellow: channel exists but active-monitoring evidence is absent.

Sources #

Methodology #

Determine whether the protocol publishes a public security disclosure channel (security@ email, Immunefi program, in-house disclosure page).

See the full factor methodology and distribution across all protocols →