Security: WritzProtocol/writz

Security

Report a vulnerability

SECURITY.md

Security Policy

Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A bug here can cost someone their BTC, so we would much rather hear about it from you than read about it later.

Reporting a vulnerability

Use GitHub private vulnerability reporting:

→ https://github.com/WritzProtocol/writz/security/advisories/new

This opens a private advisory visible only to you and the maintainers. It is the only supported channel - please do not open a public issue for a security finding, and do not email the addresses that appear in older documents.

If GitHub private reporting is unavailable to you for any reason, open a public issue containing only the sentence "I have a security finding and need a private channel" - no technical detail - and a maintainer will arrange one.

What to include

  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name

What to expect

StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report

We will keep you in the loop through the advisory thread rather than going quiet, and we will tell you plainly if we assess a finding as lower severity than you did.

Scope

In scope - the four Soroban contracts (bitcoin-spv, zk-verifier, commitment-tree, private-lend), the three Circom circuits, the P2WSH scripts in bitcoin-script/, and the SPV relayer.

Out of scope - denial of service, social engineering, findings that require physical access to infrastructure, vulnerabilities in Stellar or Bitcoin themselves, and issues already documented in docs/security/security-model.md or a published audit.

Rewards, severity bands, and the Hall of Fame live in docs/security/bug-bounty.md. Note that the protocol is on testnet and holds no user funds yet: cash rewards begin at mainnet, and testnet findings are recognised now and honoured then.

Safe harbour

We will not pursue legal action against researchers who follow this policy: report privately, do not access or modify data belonging to others, and give us a reasonable window to ship a fix before going public.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: WritzProtocol/writz
Security
Report a vulnerability

SECURITY.md

Security Policy
Writz locks real Bitcoin behind a P2WSH script and settles loans on Soroban. A
bug here can cost someone their BTC, so we would much rather hear about it from
you than read about it later.
Reporting a vulnerability
Use GitHub private vulnerability reporting:
→ https://github.com/WritzProtocol/writz/security/advisories/new
This opens a private advisory visible only to you and the maintainers. It is the
only supported channel - please do not open a public issue for a security
finding, and do not email the addresses that appear in older documents.
If GitHub private reporting is unavailable to you for any reason, open a public
issue containing only the sentence "I have a security finding and need a
private channel" - no technical detail - and a maintainer will arrange one.
What to include
  1. The affected component (contract, circuit, or service, plus function name)
  2. What an attacker can achieve, and under what preconditions
  3. Step-by-step reproduction, ideally as a failing test
  4. Your assessment of severity
  5. Whether you want to be credited, and under which name
What to expect
StageTarget
Acknowledgement48 hours
Severity assessment7 business days
Fix for Critical / High14 days
Public post-mortem (Critical / High)After the fix is live
Coordinated public disclosureOnce the fix is live, 30 days after the report
We will keep you in the loop through the advisory thread rather than going
quiet, and we will tell you plainly if we assess a finding as lower severity
than you did.
Scope
In scope - the four Soroban contracts (bitcoin-spv, zk-verifier,
commitment-tree, private-lend), the three Circom circuits, the P2WSH
scripts in bitcoin-script/, and the SPV relayer.
Out of scope - denial of service, social engineering, findings that require
physical access to infrastructure, vulnerabilities in Stellar or Bitcoin
themselves, and issues already documented in
docs/security/security-model.md or a
published audit.
Rewards, severity bands, and the Hall of Fame live in
docs/security/bug-bounty.md. Note that the
protocol is on testnet and holds no user funds yet: cash rewards begin at
mainnet, and testnet findings are recognised now and honoured then.
Safe harbour
We will not pursue legal action against researchers who follow this policy:
report privately, do not access or modify data belonging to others, and give us
a reasonable window to ship a fix before going public.
 There aren't any published security advisories