Remedy Code Of Conduct

The following document aims to provide guidelines for proper engagement on the Remedy platform and explains the actions Remedy management may take in case of violations.

When participating in programs on Remedy (further "Platform"), all Security Researchers are expected to support our community values by following the Remedy Code of Conduct (CoC). This CoC adds to the General Terms and Conditions that researchers agree to upon creating an account.

Some programs may also include specific rules of engagement or conduct within their policies, which can be enforced through program-level sanctions. Therefore, Security Researchers must review the program policies before engaging in any program.

It should also be noted that the Enforcement Measures described herein might be enforced more strictly than described below if they occur in combination or are affected by other case-specific conditions.

1. CoC Violations

1.1 Unethical Behavior

Security Researchers must act professionally and ethically. The definition of unethical behavior includes, but is not limited to:

1. Begging for a Bounty reward that is not owed to the Security Researcher based on the terms of the Program.

2. Requesting gas fees from the Platform or the Program.

3. Disputing a Report after it has been paid or marked as closed, except for requesting mediation.

4. Falsely claiming that a bug report affects an Asset in scope when it does not.

5. Exaggerating the severity of a Report to receive a higher Bounty pay-out.

6. Underreporting or misrepresenting vulnerabilities to receive a higher Bounty.

1.2 Abusive Behavior/Harassment

1. Conducting attacks based on personal characteristics, such as race, gender, religion, or sexual orientation.

2. Engaging in harassment or abusive communication with the Program, the Platform, or other Security Researchers.

1.3 Unsafe Testing/Service Degradation

Security Researchers must not perform unsafe testing without prior authorization. This includes (but is not limited to):

1. Testing with live or public testnet contracts without permission from the Program.

2. Conducting automated testing that generates excessive traffic on the Program owner's platform.

3. Attempting to exploit or attack the project on the Platform.

4. Accessing sensitive information beyond what is necessary to submit the bug report or conduct mediation.

5. Impacting the stability of customer systems outside of posted testing policies.

6. Contributing fixes to the Program's repository without obtaining explicit permission.

1.4 Irresponsible disclosure

1. Revealing the Report or its existence to the public before the Program has addressed and compensated it and fixed the bugs revealed in the report.

2. Revealing the Report to the public before 45 days have passed since the Project determined it was out of scope or did not require a fix.

3. Revealing a Report that is considered a duplicate or already known to the Program.

4. Revealing a valid Report accepted by the Program and for which the Bounty was paid without the prior written confirmation of the Program owner.

5. Disclosing sensitive information beyond what is necessary to submit the bug report or conduct mediation.

6. Publishing content that violates the law or when communicating with the Program.

1.5 Communicating with the Program Team Outside Of The Platform

1. All communication between the Security Researcher and the Project must be conducted through the platform's built-in features (e.g., chat). Any communication concerning the Programs published on the Platform conducted outside the Platform will be considered a breach of this CoC.

1.6 Theft of Intellectual Property

1. Upon accepting the Report and subsequent closing its status, the Security Researcher acknowledges that the report's ownership is transferred to the Program owner. This transfer occurs when the Security Researcher receives the Bounty and doesn’t protest the case within 7 days after the transfer.

1.7 Social Engineering

1. Phishing or conducting other social engineering attacks against the Program or the Platform is strictly prohibited.

1.8 Extortion/Blackmail

1. Engaging in extortion, blackmail, or threats of extortion/blackmail against the Program or any of its members.

2. Threaten to exploit/attack the Program or the Platform.

3. Threatening violence against the Program, Platform, or any of its members or other Security Researchers.

4. Threatening to publish or publishing people's personal information without their consent.

5. Pretending to be other Security Researchers.

NOTE: A breach of this section will most probably lead to criminal prosecution.

2. Enforcement Measures

Point #	Incident	1st violation	2nd violation	3rd violation	4th violation	5th violation
2.1	Unethical Behavior	Educational	1st Warning	Final Warning	Temporary ban (1 month)	Permanent ban
2.2	Abusive Behavior/Harassment	Final Warning	Temporary ban (1 month)	Permanent ban
2.3	Unsafe Testing/Service Degradation	1st Warning	Final Warning	Temporary ban (1 month)	Permanent ban
2.4	Irresponsible disclosure	Temporary ban (1 month)	Permanent ban
2.5	Communicating with the Program Team Outside Of The Platform	Educational	Final Warning	Temporary ban (1 month)	Permanent ban
2.6	Theft of Intellectual Property	Temporary ban (1 month)	Permanent ban
2.7	Social Engineering	Permanent ban
2.8	Extortion/Blackmail	Permanent ban
2.9	Spamming	Educational	1st Warning	Final Warning	Temporary ban (1 month)	Permanent ban