BitKuruş
Wallet

Reference document

Security Policy

This is the authoritative version, rendered from the project's own source document rather than retyped — so it cannot drift from what the team maintains.

All documents

Note: Reference documents are maintained in English.

BitKuruş is a cryptographic token ledger. We take the integrity of the ledger, the replication layer, and user key material seriously and welcome coordinated disclosure from security researchers.

Supported scope

In scope for security reports:

  • The transaction engine and UTXO validation (app/Services/Transactions/*).
  • The cryptographic layer: Ed25519 signing, canonical JSON, node identity (app/Services/Crypto/*).
  • The replication / peer layer: envelope verification, idempotency, integrity alerts (app/Services/Replication/*, app/Services/Network/*).
  • Public HTTP API (routes/api.php, app/Http/Controllers/Api/*).
  • The browser wallet client (public/bitkurus/wallet.js and related).

Out of scope:

  • Denial-of-service via raw request volume (the API is rate-limited per route group; report logic amplification instead).
  • Findings that require a compromised validator private key — the trust model (see docs/THREAT_MODEL.md) already documents that an allowlisted validator is trusted. Report ways to break invariants without a trusted key.
  • Social engineering and physical attacks.

Reporting a vulnerability

Do not open a public GitHub issue for a security vulnerability.

Email security@bitkurush.org (or, until that inbox is live, sencerhan76@gmail.com) with:

  • A description of the issue and its impact.
  • Reproduction steps or a proof of concept.
  • The affected component / file paths and, if known, a suggested fix.

We aim to acknowledge reports within 72 hours and to provide a remediation timeline within 7 days. Please give us a reasonable window to fix the issue before any public disclosure. We will credit reporters who wish to be named.

Bug bounty

We run a discretionary bounty for valid, previously-unknown vulnerabilities. Rewards are scaled by severity and by whether the finding breaks a ledger invariant (double-spend, unauthorized mint, supply-cap bypass, signature forgery, replication forgery). Contact the security address above before testing against live federation nodes — we will provide a testnet target.

Verifying node integrity yourself

You do not need our permission to audit the ledger. Every node exposes signed, deterministic endpoints:

  • GET /api/state — SHA-256 state_hash over the active token set.
  • GET /api/network — the node's Ed25519-signed identity card.
  • GET /api/ledger/export — a byte-identical canonical snapshot with a canonical_hash.

The open-source bitkurus-ledger-verifier downloads any node's ledger, re-verifies every signature, and cross-checks the canonical_hash across nodes.