Skip to content
AtheronBlockchain
EN

An illustration of a block checked against the parents it names by hash. It is not live network data.

Security

Found a flaw?

Tell us first.

How to report a problem in the specification, the node, the wallet or this site, and what we promise in return.

Contents7 sections
  1. 1What this covers
  2. 2How to report
  3. 3How quickly we answer
  4. 4Safe harbour
  5. 5The rules
  6. 6Disclosure and credit
  7. 7Changes to this policy
Last updated
October 3, 2026
Version
2026-10-03

If you read one thing

If you find a security problem in the ATON specification, the node, the reference wallet or this site, tell us privately before anyone else. We answer quickly, work with you on a fix, credit you if you want, and take no legal action over research done in good faith under these rules.

Who you are dealing with

Company
Atheron Network Inc.
Registered address
1631 Dickson Ave., Suite 1100 Kelowna, BC V1Y 0B5 CA
Business Number
788400448
GST/HST
788400448 RT0001
Write to us

01What this covers

  • The ATON specification.
  • The ATON node and reference wallet, as published in our public repositories.
  • This site, aton-chain.com, and its waitlist.

The network is not running yet, so there are no live coins at risk. A flaw in the design is still worth reporting now, while it is cheapest to fix.

Services run by others, such as Cloudflare, Discord, Telegram, X and Bluesky, are not covered. Report problems in them to those companies.

02How to report

Send your report to: security@aton-network.org

Please include:

  • what you found, and where: the document, repository and version, or the page;
  • the steps that show it, and what someone could do with it;
  • how to reach you, and whether you want to be credited, and under what name.

Please do not include other people's information, and send only what is needed to show the problem.

03How quickly we answer

StepWhen
We confirm we have your reportWithin 3 business days
We tell you what we think of it, and what happens nextWithin 10 business days
We keep you up to date while we work on itAt least every 14 days
We aim to have a fix publishedWithin 90 days, sooner for anything serious

Business days are Monday to Friday, except public holidays in British Columbia.

04Safe harbour

If you act in good faith and follow the rules below, we treat your research as authorised. We will not take legal action against you or report you to the authorities for it. If somebody else does, we will say that you acted under this policy.

We can only speak for ourselves. Other people's systems, including services we use, are theirs, and this policy gives no permission to test them.

05The rules

  • Test only on your own copies, your own accounts and a private test network of your own.
  • Do not read, change or delete anybody else's information. If you reach some, stop, and tell us.
  • No denial of service, no spam, no tricking our people, and no physical attempts.
  • Do not sign other people up to the waitlist.
  • Give us a fair chance to fix the problem before you tell anyone else.
  • Do not ask for payment as a condition of telling us, or threaten to publish.

06Disclosure and credit

We agree a date with you to publish the details, normally once a fix is out. If we cannot agree, the details may be published 90 days after your report. When a fix is published, we credit you in its notes if you want, under the name you choose.

There is no paid bug bounty at the moment.

07Changes to this policy

When this policy changes, we publish a new version with its date. A report is handled under the version that applied when you sent it. See also the terms.