Disclosure SLA public

Evidence summary #

Immunefi program applies 'Category 2: Notice Required' for responsible publication — this governs researcher public disclosure timing, not the team's acknowledgment-time SLA. No explicit acknowledgment-time SLA (e.g., '72h acknowledge') is published in the Immunefi program page, Veda docs (docs.veda.tech), or veda.tech. No SECURITY.md in the repo (data cache security_md_present=false). The absence of a stated response SLA means researchers have no formal guarantee of timely acknowledgment. Yellow: disclosure channel exists but no acknowledgment SLA is published.

Sources #

Methodology #

Determine whether the protocol publishes an acknowledgment-time SLA for disclosed vulnerabilities (e.g., 72h ack).

See the full factor methodology and distribution across all protocols →