Found a security issue?
Tell us directly.

What to report

Report vulnerabilities affecting the public ArkPool website, public pool services, or ArkPool-owned open-source gateway and firmware projects. Examples include authentication or authorization failures, injection, secret exposure, unsafe defaults, payout-accounting integrity problems, and practical ways to bypass documented security boundaries.

Ordinary support questions, expected alpha limitations, profitability concerns, upstream outages, and already-public dependency advisories without an ArkPool-specific impact are not vulnerability reports.

What to include

• The affected URL, component, or public repository.
• A concise impact statement and reproducible steps.
• The smallest sanitized proof needed to demonstrate the issue.
• Any suggested mitigation or relevant upstream advisory.

Do not send wallet seeds, private keys, wallet databases, API tokens, passwords, private miner addresses, or unrelated personal data. Redact logs before attaching them. ArkPool will never need your wallet seed to investigate a report.

Responsible testing boundaries

Use good-faith, minimally invasive testing. Do not access or modify another person’s data, interrupt mining or payouts, send spam, perform denial-of-service or high-volume automated testing, exploit real funds, or retain data beyond what is necessary to report the issue. Stop when you have enough evidence and allow a reasonable opportunity to investigate before public disclosure.

This page does not authorize access to private infrastructure, wallet systems, operator accounts, or third-party services. It is not a bug-bounty promise or a guarantee of compensation.

Report privacy and response

The public alias forwards through Cloudflare Email Routing to a private mailbox. Email inherently exposes routing metadata to the mail providers involved. Avoid unnecessary sensitive information and use a new report thread for each issue.

We will review actionable reports and may ask for clarification. Response and remediation times depend on severity, reproducibility, and operational risk. If email is unavailable, check the public changelog for service notices rather than posting an unpatched vulnerability publicly.