Add Responsible Disclosure Process [RFC]

electo

Hi All

I wanted to open up a discussion on how to responsibly disclose issues to Olympus. Currently the only way seems to be Immunefi which seems very limited and does not cover everything. (If there is a place already, its not very obvious).

1. Immunefi has a tight scope for smart contracts deployed.
2. While GitHub public issue disclosures are ok for day to day, this is not the place to put a responsible disclosure.

I suggest a mailing list or email (with pgps) be setup where these disclosures can be sent.
Bitcoin core & Coinfinity have good examples.

This would help cover any issues in front-end, smart contracts, social etc. which do not fall under the Immunefi program.

Since Olympus is a DAO, its extremely difficult to get a hold of someone and know this is the right person to talk to and discord DMs also don't work since you need to add them as a friend first.

This process (whatever the community agrees on) should then be posted on the main dapp, GitHub and docs. Going into discord and trying to get a hold of someone is not responsible nor should be encouraged since there are chances of sensitive information landing in wrong places.

Thanks,
electo @ team Abachi.

BobbySchmurda

Couldnt agree with this more. I was thinking of something similar to this (not nearly as detailed, and geared more for the investors)….. a newsletter of some sort talking ab whats being worked on and accomplishments reached…. so we dont have that radio silence like during migration. Im not even talking about anything that detailed…. just a few bulletin points bi-weekly or so. Love the devs but they need a few outward faces to talk to investors… i love that they always have their heads down working but someone needs to communicate to the people better and in a steadier fashion. I think @Zeus being all up on Twitter is great. It shows that even in the face of adversity hes there defending the project and it shows hes not bouncing with the money which new investors fear. But i dont want to get away from your point @electo its a good point, just fell under the same line of communication.