Report vulnerabilities privately by email to security@tempo.xyz. Never report them in public issues, pull requests, or discussions.

Include:

• the affected project and contract, script, or package, and the commit you tested;
• the impact, such as lost, stranded, or misaccounted funds, broken authority, or a privacy leak;
• steps or a proof-of-concept test that reproduces it, for example a Foundry test; and
• any deployment, profile, or configuration the issue depends on.

Keep the report confidential until we have confirmed a fix and agreed on disclosure with you.

In scope:

• Tempo Earn: the contracts in earn/src/, except earn/src/demo/;
• the Zone router: the contracts in zone-router/src/, including its spenders;
• card spend: cards/src/, the provider-agnostic core and our code for each provider (Bridge's "TS" handler and BridgeProvider, Rain's RainProvider); and
• the deployment tooling: deployments/, each project's script/, and the profile lifecycle they implement.

Out of scope:

• earn/src/demo/ and test fixtures, including every test/ directory, localnet/, e2e/, and committed fixture artifacts, which are not production code;
• vendored third-party code, such as the card providers' contracts in cards/vendor/, and third-party venues such as ERC-4626 vaults, Veda, and PropAMM. Report issues in them to their owners. A bug in how Tempo's contracts integrate with them is in scope.

Each project documents its trust assumptions, privileged roles, and privacy boundary: Earn's security and privacy model, the Zone router, and card spend's design. Behavior documented there as trusted or visible is not a vulnerability by itself.

These contracts have no bug bounty.

Earn's completed audits, their scope, and the contracts changed or added since are listed on its audits page. Bridge card spend's design gives its audit scope: the "TS" handler, BridgeProvider, CardSpender, CardFactory, ZoneRouter and ZoneRouterFactory.