Security & Vulnerability Disclosure

We want to hear about security problems in TCC Network — the app, the websites, the wallet, the NFT marketplace, the blockchain nodes and the APIs behind them. This page tells you what is in scope, how to report, what we commit to in return, and what we pay.

1. How we protect users

Some design decisions that are relevant when you assess our attack surface:

• — Wallet keys never leave the device. Keys are generated locally, encrypted with a user-chosen PIN, and stored on the device. We hold no copy and cannot recover a lost key.
• — Post-quantum signatures. On-chain transactions are signed with ML-DSA.
• — Data minimisation in KYC. Identity checks store derived values rather than raw documents where possible; submitted images are encrypted at rest and deleted after review.
• — Encrypted offsite backups. Database backups are encrypted before they leave our infrastructure.
• — Non-custodial marketplace. The market settles on-chain; we do not hold user assets.

2. In scope

• — tcc-coin.com and its subdomains, including the NFT marketplace and the wallet.
• — The TCC mobile applications.
• — Public APIs and RPC endpoints operated by us.
• — The on-chain market program and the node software.

Vulnerability classes we especially want: theft or unauthorised movement of funds or NFTs; recovery or leakage of private keys or recovery phrases; authentication or authorisation bypass; unauthorised admin access; remote code execution; SQL/command injection; stored cross-site scripting; insecure direct object references exposing other users' data; chain consensus or minting flaws.

3. Out of scope

• — Denial of service, volumetric or stress testing of any kind.
• — Social engineering, phishing, or physical attacks against our team or users.
• — Reports generated solely by an automated scanner, with no demonstrated impact.
• — Missing security headers, cookie flags, or TLS configuration nits with no exploit path.
• — Self-XSS, clickjacking on pages with no sensitive action, and missing rate limits with no demonstrated impact.
• — Vulnerabilities in third-party services we do not control.
• — Attacks requiring a rooted or jailbroken device, a compromised OS, or physical access to an unlocked device.
• — Reports about the economics of the token, price, or reward parameters.
• — Outdated dependency versions without a working exploit against us.

4. Rules of engagement

While testing, you must:

• — Use only your own accounts and wallets. Do not access, modify or download other people's data. If you encounter someone else's data, stop and tell us.
• — Not degrade the service. No denial of service, no automated brute forcing at volume, no spamming the chain.
• — Not destroy data or make irreversible changes.
• — Stop as soon as you have proof. Demonstrate the vulnerability minimally; do not pivot deeper than needed to show impact.
• — Not extort. Withholding a report pending payment, or threatening disclosure to force payment, voids any reward and any safe harbour.

5. How to report

Email [email protected], subject "Security report". A good report contains:

• — a one-line summary and your severity assessment;
• — the affected component, URL, endpoint, contract address or app version;
• — exact reproduction steps — request/response pairs, a proof-of-concept, or a short video;
• — the realistic impact: what an attacker gains, and what it costs a user;
• — any accounts or wallet addresses you used while testing;
• — a TCC address for payment, if you want a reward.

We accept reports in English or Vietnamese. Machine-readable contact details are published at /.well-known/security.txt.

6. What we commit to

• — Acknowledge within 3 business days.
• — Initial assessment and severity within 10 business days.
• — Keep you updated at least every 14 days until the issue is resolved.
• — Tell you when the fix ships, and credit you if you want credit.
• — Not take legal action against you for research conducted in line with this policy.

7. Safe harbour

This commitment does not extend to activity that breaches the rules above — in particular accessing other users' data, denial of service, extortion, or disclosing an unfixed vulnerability publicly.

8. Rewards

We pay rewards in TCC for valid, previously unknown vulnerabilities, at the tiers below. The final amount within a tier depends on impact, exploitability, report quality, and whether a working proof-of-concept is included.

Swipe the table sideways to see the examples column.

Maximum 500,000 TCC per report.

Conditions

• — Only the first reporter of a given issue is eligible. Duplicates receive credit, not payment.
• — The issue must be previously unknown to us and not already scheduled for fix.
• — Out-of-scope findings and rule breaches are not eligible.
• — Severity and amount are decided by the TCC Core Team; we will explain our reasoning.
• — Rewards are paid in TCC to an address you provide, normally within 30 days of the fix shipping.
• — You are responsible for any taxes on a reward.
• — Members of the Core Team and their immediate families are not eligible.
• — We may revise these tiers; the version in force is the one published when you reported.

9. Coordinated disclosure

Please keep the issue confidential until we have shipped a fix. Our target windows from acknowledgement:

• — Critical / High: 90 days.
• — Medium / Low: 120 days.

If we need longer we will tell you why and agree a new date with you. After the fix ships you are free to publish, and we are happy to review a draft for factual accuracy. If we have not responded at all within 30 days, you may disclose — but please try to reach us again first.

10. Credit

With your permission we credit reporters by name or handle when the fix ships. Tell us in your report how you would like to be credited, or that you prefer to stay anonymous.

11. Contact

Security reports: [email protected] (subject: "Security report")
Machine-readable: /.well-known/security.txt
Languages: English, Vietnamese

For non-security matters see the NFT Marketplace Terms, Content & Moderation Policy or the IP Takedown Procedure.