📚 NEW: Building Financial Software on SolanaFree book with 10 complete programs, from options to perps.

// security

Responsible Disclosure

Found a security issue affecting Quicknode systems, applications, or infrastructure? Review our reporting guidelines below and submit a report.

Report A Vulnerability

Responsible Disclosure Policy

Security and platform integrity are core priorities at Quicknode. This policy outlines our responsible disclosure process and response expectations.

Response Commitments

We aim to meet the following response targets for valid submissions: an initial response within 5 business days, triage within 10 business days, and resolution based on severity and complexity. Reporters are kept informed throughout review and remediation.

Disclosure Expectations

This is a private disclosure program. Vulnerabilities and program details may not be publicly disclosed without written consent from Quicknode, including after resolution.

Safe Harbor

Activities conducted in good faith and in accordance with this policy are authorized. Quicknode will not initiate legal action related to research conducted under this policy and will confirm compliance if third-party claims arise.

Reporting Guidelines

Submission criteria and scope for valid security reports.

Provide clear, complete, and reproducible steps to demonstrate the issue.
Submit one vulnerability per report, unless chaining is required to demonstrate impact.
Duplicate reports are triaged based on the first valid submission received.
Multiple vulnerabilities caused by a single root issue will be treated as one report.
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
Act in good faith—avoid privacy violations, data destruction, or service disruption. Only test against accounts you own or have explicit permission to use.

When reporting vulnerabilities, consider both exploitability and security impact. The following issues are out of scope:

Clickjacking on pages without sensitive actions.
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms without sensitive operations.
Attacks requiring Man-in-the-Middle (MITM) positioning or physical access to a user’s device.
Reports of known vulnerable libraries without a working Proof of Concept.
Comma-Separated Values (CSV) injection without demonstrated exploitability.
Missing SSL/TLS best-practice configurations.
Any activity that could disrupt service availability (including DoS scenarios).
Content spoofing or text injection without a viable attack vector or ability to modify HTML/CSS.
Rate-limiting or brute-force concerns on non-authentication endpoints.
Missing Content Security Policy (CSP) best practices.
Missing HttpOnly or Secure flags on cookies.
Email configuration best-practice issues (e.g., incomplete or missing SPF, DKIM, or DMARC records)
Issues affecting only outdated or unpatched browsers (more than two stable versions behind).
Software version disclosure, banner identification, or descriptive error messages or headers (e.g. stack traces, application or server errors).
Tabnabbing.
Open redirects without additional demonstrated security impact.
Issues requiring unlikely or highly impractical user interaction.

Responsible Disclosure

Responsible Disclosure Policy

Response Commitments

Disclosure Expectations

Safe Harbor

Reporting Guidelines

Want to stay updated?

Developer Tools

Docs & Guides