# Security policy

## Scope

This policy covers **this website repository only**: the static HTML/CSS files, images,
and hosting configuration (`_headers`, `_redirects`, `deploy/nginx-snippet.conf`) for
https://bitcoin-ii.org.

Vulnerabilities in the **BitcoinII Core** software (node, wallet, consensus) belong to
https://github.com/Bitcoin-II/BitcoinII-Core. TODO(verify): BitcoinII Core's security
reporting process. (Its `SECURITY.md` currently still contains upstream Bitcoin Core contact
details, so confirm the right contact with the maintainers.)

## How to report

- Use GitHub's **"Report a vulnerability"** button on this repository's **Security** tab
  (private vulnerability reporting). TODO(owner): enable it under
  Settings → Code security → Private vulnerability reporting.
- Or email: TODO(owner): security contact email.

**Please do not open a public issue for a vulnerability.**

## What to include

- The page or file affected, and the URL if it's live.
- What the problem is, and how to reproduce it.
- What an attacker could do with it.
- Screenshots or request/response headers if useful.

## What happens next

- We aim to acknowledge reports within TODO(owner): response target (for example 72 hours).
- We'll tell you when it's fixed and credit you if you'd like.
- There is **no bug bounty** unless one is announced.

## Phishing and impersonation

**This site never asks for seed phrases, private keys or wallet files.** It has no login, no
wallet connection and no forms. If you see any page, app, social account or person that
claims to be BitcoinII and asks for these, please report it.