Vulnerability Disclosure Policy

How to report a security vulnerability to Alta, and what you can expect from us.

Last updated: 4 November 2026

Introduction

Nexus Networks, Inc., a Delaware corporation, operating as “Alta” (formerly “Metal”) (“Alta,” “we,” “us,” or “our”), welcomes feedback from security researchers and the general public to help improve our security. References to “Alta” include its subsidiaries, and the commitments and Safe Harbor in this policy are given by each of them. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security issues in any of our assets, we want to hear from you. This policy outlines steps for reporting vulnerabilities to us, what we expect, and what you can expect from us.

Systems in Scope

This policy applies to any digital assets owned, operated, or maintained by Alta, including our websites, the Alta testnet and the services we run on it, and the Alta node software, smart contracts, and zero-knowledge circuits that we publish or deploy.

Out of Scope

  • Assets or other equipment not owned or operated by Alta.
  • Contracts and services that third parties deploy or run on the Alta testnet.
  • Denial-of-service testing, and any other test that impairs access to, or damages, a system or data.
  • Social engineering, such as phishing, and physical testing of our offices or people.

Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority. If you find a vulnerability in open-source software that our systems depend on, please report it to us as well as to that project’s maintainers, so that we can coordinate a fix.

Our Commitments

When working with us, according to this policy, you can expect us to:

  • Acknowledge your report within five business days, and work with you to understand and validate it;
  • Strive to keep you informed about the progress of remediating a vulnerability as it is processed;
  • Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints;
  • Keep your identity confidential and not share it outside Alta without your permission, unless required by law; and
  • Extend Safe Harbor for your vulnerability research that is related to this policy.

We do not offer rewards or payment for reports.

Our Expectations

In participating in our vulnerability disclosure program in good faith, we ask that you:

  • Play by the rules, including following this policy and any other relevant agreements;
  • Report any vulnerability you’ve discovered promptly;
  • Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
  • Use only the Official Channels to discuss vulnerability information with us;
  • Provide us a reasonable amount of time to resolve the issue before you disclose it publicly. Do not disclose publicly until the issue is resolved or 90 days have passed since your initial report, whichever comes first, unless we agree otherwise in writing. For complex issues (for example, fixes that require a smart contract or protocol upgrade), we may ask you for a reasonable extension and will explain why;
  • Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
  • If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), credit card data, or proprietary information, and handle that data as described under Confidentiality and Data Handling below;
  • Do not exploit a vulnerability to transfer, mint, burn, lock, or otherwise interfere with tokens, assets, or accounts you do not own, even on the testnet;
  • You should only interact with test accounts you own or with explicit permission from the account holder; and
  • Do not engage in extortion.

Confidentiality and Data Handling

Keep the details of any vulnerability you report, and any non-public information about our systems that you learn through your research, confidential. Share them only with us through the Official Channels until the issue is resolved or we agree in writing on a disclosure date. Before any public disclosure, give us reasonable advance notice and a copy of what you intend to publish.

If you access or receive any non-public data during your research, including personal information, credentials, private keys, or proprietary information, you must not copy, retain, use, or share it beyond what is needed to report it to us. Once you have reported it, securely delete it and, on request, confirm that you have done so. Tell us in your report what data you accessed, so that we can meet our own legal obligations.

Nothing in this policy prevents you from reporting to a regulator or law enforcement agency where the law requires you to do so.

Official Channels

Please report security issues by email to [email protected], providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue. By submitting a report, you permit us to use its contents to investigate and fix the issue, and to share relevant technical details with affected vendors or open-source maintainers without identifying you unless you agree. We handle reporters’ personal information as described in our Privacy Policy.

Safe Harbor

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

  • Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
  • Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
  • Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
  • Helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Safe Harbor does not apply to research that is not conducted in good faith or in accordance with this policy, including extortion, retaining or disclosing data in breach of this policy, or testing out-of-scope systems. Nothing in this policy limits our ability to comply with applicable law or to respond to valid legal process.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of Alta, and that the policy does not bind independent third parties.

Relationship to Other Agreements

If this policy conflicts with our Terms of Service or Acceptable Use Policy, this policy controls. This policy does not modify any separate written agreement you have with Alta (such as a developer NDA, design partner agreement, letter of intent, or employment or contractor agreement), and does not apply to activities conducted under such an agreement. Current Alta employees and contractors should report vulnerabilities through our internal channels rather than under this policy.

Changes to This Policy

We may update this policy from time to time. Research is governed by the version of this policy in effect when it was conducted. The date at the top of this policy shows when it was last updated.

This policy is adapted from the disclose.io vulnerability disclosure policy template.