Found a bug? Tell us on X.
If you have found a way to break Longevity, take funds that are not yours, or make the site say something untrue, this page is how to report it.
Where to send it
That account on X is the only contact. Reports are answered there.
If the bug could put anyone's funds at risk, do not post the details in public. Say that you have a report and ask to continue in a direct message.
What is in scope
- The site
longevity.trading and every page on it.
- The API
Everything under longevity.trading/api, including the routes that build a transaction for a wallet to sign.
- deal_guard
The OTC desk's program on Solana. GetF3fc3ap4fkJbkSrptj2mPLya65e5LozUPHU1p44TQ
- stake_vault
The staking program on Solana. C5U12T5LuoJ7VaUQGCAKgc72VATbhKMfSeKoxTGk4NNG
Both programs are read live from the chain on the Proof page.
What a good report contains
- What is affected
The page, the API route, or the program and the instruction.
- How to reproduce it
The steps in order, with the requests or the transaction signatures. Use your own wallets and your own funds.
- What it allows
What someone could take, change or stop by using it, and what they would need to start.
- Where to reply
The X account you want the answer sent to, if it is not the one you write from.
For scanners
The same contact is published at /.well-known/security.txt, in the standard format.