Security & responsible disclosure

Contact

Email: security@carbon12.network (PGP key TBC)

Include reproduction steps, impact, and suggested fix if available.

Scope

Report vulnerabilities in:

• c12d consensus / module logic (Carbon12-Chain/chain)
• Public testnet infrastructure operated by Carbon12 Labs (RPC, REST, faucet)
• Carbon12-Chain/explorer and ingest writer deployments

This documentation site is static HTML; content issues belong in GitHub issues on Carbon12-Chain/docs.

You may also open a private security advisory on the affected GitHub repository (chain, explorer, or docs).

Safe testing

• Use testnet keys and faucet funds only.
• Do not attack production operator infrastructure without written authorization.
• Do not exfiltrate user data from explorer deployments.

Dependencies

Pinned toolchain versions: chain ADR-0001 (go.mod, Cosmos SDK, CometBFT, cosmos-evm). Monitor upstream CVE advisories for those stacks.

Key material

Never commit INGEST_API_KEY, validator keys, or devnet/genesis/keys.json hex to public repos. Writer service fails closed without API key configuration.