Meridian DAO rulebook v1
CurrentInitial disclosure program.
Assets in scope
2 assets
| ID | Asset | Type | Target |
|---|---|---|---|
| MRD-1 | Governance portal | Website / app | https://gov.meridian.example |
| MRD-2 | Treasury API | API | https://api.meridian.example |
Impacts & severity
Severity follows mechanically from the demonstrated impact.
- IMP-C1Account takeover or execution of arbitrary code on serversMust demonstrate: Demonstrated takeover of a victim account or RCE.
- IMP-H1Access to sensitive data of other usersMust demonstrate: Demonstrated read access to another user's private data.
- IMP-M1State-changing action on behalf of another userMust demonstrate: Demonstrated CSRF/IDOR causing a state change.
- IMP-L1Information disclosure without direct user impactMust demonstrate: Exposure of non-sensitive internal details.
Proof-of-Concept requirements
- POC-1Critical and High reports must include a runnable PoC demonstrating the claimed impact end-to-end.
- POC-2The PoC must state its environment (fork block, commit, build) and must never be executed against production.
Testing restrictions
Allowed: Staging environment provided on request
- TEST-1Testing against production systems or mainnet deployments is prohibited; use local forks or staging.
- TEST-2Phishing, social engineering and physical attacks are prohibited.
- TEST-3Denial-of-service attacks against project infrastructure are prohibited.
Out-of-scope & exclusions
A closure as out of scope must cite one of these ids.
- EXCL-1Missing security headers or best practices without demonstrated impact.
- EXCL-2Attacks requiring physical access to a victim's unlocked device.
- EXCL-3Rate-limiting or brute-force issues on non-authentication endpoints.
Policies
The first report that identifies a root cause is eligible. Later reports sharing the same root cause are duplicates unless they demonstrate a materially higher impact.
Issues in published audits or recorded as known-issue commitments before the submission timestamp are ineligible.
Public disclosure requires approval from both parties after the fix is deployed and verified.
Either decision may be escalated to an independent platform mediator within 7 days of the project's final decision.
Recognition only: this program pays no monetary rewards. Valid findings receive a verified acknowledgement and credit on the researcher's Proofline profile.