🔐 NOYD Vulnerability Disclosure Program

Category	Badge	Description
License		Software license
Go Version		Minimum Go version
PQC Algorithms		NIST PQC standards
Build		CI/CD build status
Issues		Open issues count
Pull Requests		Open PRs count
Contributors		Contributor count
**Last Commit](https://img.shields.io/github/last-commit/noyddev/noyd-vulnerability-program/main?logo=github)	Active development

---

🎯 Welcome, Security Researchers

Thank you for your interest in securing the NOYD ecosystem. This repository is dedicated to ethical hackers, security researchers, and bug bounty hunters who want to help us identify and remediate vulnerabilities in our post-quantum cryptography (PQC) infrastructure.

We take security seriously and appreciate the community's help in keeping NOYD safe for everyone. This document outlines the scope, severity classifications, reward structures, and testing guidelines for participating in our coordinated vulnerability disclosure program.

---

📚 Background: Post-Quantum Cryptography with Go

NOYD is a high-performance post-quantum secure transport layer built on NIST-standardized lattice-based cryptographic primitives:

Primitive	Standard	Security Level	Use Case
ML-KEM-768	NIST FIPS 203	Level 3 (~192-bit classical)	Key encapsulation & key exchange
ML-DSA-65	NIST FIPS 204	Level 3 (~192-bit classical)	Digital signatures & authentication

These algorithms are designed to resist attacks from both classical computers and future quantum computers. The NOYD SDK provides a Go-language interface for applications to establish post-quantum secured sessions with the NOYD backend infrastructure.

Key Components in Scope

• Go SDK (github.com/noyddev/noyd-public-sdk) — Public SDK facade for connecting to NOYD nodes
• Handshake Protocol — ML-KEM-768 encapsulation + ML-DSA-65 signing handshake logic
• Telemetry Endpoints — Health check and metrics collection endpoints
• Session Management — Connection establishment, maintenance, and teardown
• Wire Protocol Parsing — Frame encoding/decoding for the 64KB deterministic envelope

---

🎯 Program Scope

✅ In-Scope Targets

The following targets are authorized for security testing under this VDP:

Target	Type	Description
noyd-public-sdk.onrender.com	Backend API	Production NOYD telemetry and health endpoints
github.com/noyddev/noyd-public-sdk	SDK Repository	Go SDK source code and dependencies
This repository	Testing Infrastructure	Fuzzing harnesses, mock servers, and test tools

🔴 Out-of-Scope Targets

The following are explicitly prohibited from testing:

Target	Reason
noyd.dev (marketing site)	Non-cryptographic infrastructure
Third-party cloud providers (AWS, GCP, Azure)	Outside NOYD's control
Social engineering attacks	Out of scope for technical VDP
Denial-of-service attacks	Do not disrupt production services
Any infrastructure not listed in In-Scope	Not authorized

⚠️ Important Restrictions

• Rate limiting: Respect API rate limits; DoS attacks are prohibited
• Data handling: Do not exfiltrate, modify, or destroy data
• Persistence: Do not attempt to establish persistent access
• Production impact: Minimize impact to production services
• Internal systems: The NOYD Core cryptographic engine is proprietary and NOT in scope

---

📊 Severity Classification

We use CVSS v3.1 for vulnerability severity scoring. Rewards are calibrated to impact.

Reward Structure

Severity	CVSS Score	Reward Range	Examples
🟢 Critical	9.0 – 10.0	$5,000 – $25,000	RCE, complete session hijacking, key extraction
🟠 High	7.0 – 8.9	$2,000 – $5,000	Authentication bypass, significant data exposure
🟡 Medium	4.0 – 6.9	$500 – $2,000	XSS, CSRF, information disclosure
🔵 Low	0.1 – 3.9	$100 – $500	Minor information leaks, low-impact logic bugs

Severity Criteria for NOYD-Specific Issues

Category	Criteria	Example Findings
Cryptographic	Any weakness in PQC implementation	Invalid curve attacks, weak randomness, timing leaks
Protocol	Handshake/state machine flaws	Session fixation, replay attacks, improper state transitions
Memory Safety	Parsing vulnerabilities	Buffer overflows, memory leaks, use-after-free in framing
Authentication	Bypass or weakness	API key leakage, improper session validation
Availability	DoS conditions	Panic on malformed packets, resource exhaustion

---

🛠️ Testing Tools & Resources

This repository provides testing harnesses and scaffolding for security researchers.

noyd-vulnerability-program/
├── README.md                  # This file
├── SECURITY.md                # Responsible disclosure policy
├── CODE_OF_CONDUCT.md         # Community guidelines
├── go.mod                     # Go module definition
├── tools/
│   ├── fuzz_test.go          # go-fuzz harness for handshake parsing
│   └── mock_server.go        # Lightweight mock NOYD server for local testing
└── .github/
    └── workflows/
        └── security-scans.yml # CI/CD security scanning

Getting Started

# Clone this repository
git clone https://github.com/noyddev/noyd-vulnerability-program.git
cd noyd-vulnerability-program

# Install dependencies
go mod download

# Run the mock server locally
go run tools/mock_server.go

# Run fuzz tests (requires go-fuzz installed)
go install github.com/dvyukov/go-fuzz/go-fuzz@latest
go-fuzz-build github.com/noyddev/noyd-vulnerability-program/tools
go-fuzz -bin=./tools-fuzz.zip

---

🔬 Testing Guidelines

What We Encourage

✅ Authorized testing on in-scope targets only
✅ Thorough documentation of steps to reproduce (PoC encouraged)
✅ Responsible disclosure within 24 hours of initial finding
✅ Cryptographic analysis of ML-KEM-768 and ML-DSA-65 usage
✅ Protocol fuzzing on handshake and framing logic
✅ Session security testing — token validation, session lifecycle
✅ Error handling analysis — how the SDK responds to malformed input

What We Discourage

❌ Do not attack production infrastructure with automated tools without coordination
❌ Do not publicly disclose vulnerabilities before a fix is available
❌ Do not social engineer NOYD staff or partners
❌ Do not access data unrelated to your security research
❌ Do not attempt to reverse-engineer the proprietary NOYD Core binary

---

📋 Report a Vulnerability

Reporting Channels (in order of preference)

1. GitHub Private Advisory (Recommended)

   • Go to github.com/noyddev/noyd-public-sdk/security/advisories/new
   • Use the "Report a vulnerability" template
   • This provides encrypted communication and automatic tracking

2. Encrypted Email

   • Send to: meska.py@gmail.com
   • PGP Key: Available on keybase.io/noyd
   • Include: Description, PoC, impact assessment, suggested remediation

3. This Repository's Issues (For test tool bugs only)

   • Use the "Security Bug Report" issue template
   • Do NOT include sensitive details in public issues

What to Include in Your Report

Vulnerability Title: [Brief, descriptive title]
CVSS v3.1 Score: [0.0 - 10.0]
CVSS Vector: [CVSS:3.1/...]

Affected Component: [SDK version, endpoint, or tool]
Attack Type: [e.g., Buffer Overflow, Authentication Bypass, etc.]
Attack Scenario: [Step-by-step reproduction steps]
Impact: [What an attacker could achieve]
Suggested Remediation: [If you have one]

Proof of Concept: [Code, screenshots, or logs]
Environment: [Go version, OS, SDK commit hash]

---

🕐 Response SLAs

We are committed to responding to vulnerability reports promptly.

Response	Timeline
Initial Acknowledgment	Within 24 hours
Status Update	Within 7 days
Fix Timeline	Within 90 days (critical), 180 days (high)
Public Disclosure	Coordinated with researcher after fix

Safe Harbor

NOYD considers security research conducted in accordance with this policy to be:

• Authorized under the Computer Fraud and Abuse Act (CFAA) and similar laws
• Protected from legal action by third parties
• Recognized for bug bounty eligibility

If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

---

🏆 Recognition

In addition to financial rewards, we recognize contributing researchers:

• Hall of Fame: Listed on our security acknowledgments page
• Coordinated Disclosure: Your name/handle alongside your finding (unless anonymous)
• NOYD Swag: Exclusive security researcher merchandise for critical findings

---

📞 Contact

Channel	Use Case
Security Advisories	Vulnerability reports
Discussions	General security questions
meska.py@gmail.com	Encrypted email (PGP available)

---

📄 Additional Resources

• NOYD Public SDK — The main SDK repository
• NOYD Whitepaper — Technical deep-dive
• NIST PQC Standards — ML-KEM-768 & ML-DSA-65 specs
• CVSS v3.1 Calculator — Severity scoring

---

Thank you for helping keep NOYD secure! 🔐

Last updated: 2025-01-15 | Version: 1.0