If you discover a security vulnerability in P&L, please report it responsibly.
- Email: predictlaunchpump@gmail.com
- Discord: P&L Security Channel
Please DO NOT:
- Open a public GitHub issue for security vulnerabilities
- Exploit the vulnerability on mainnet
- Share details publicly before the issue is resolved
What to include in your report:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes (optional)
- Acknowledgment: Within 48 hours
- Initial assessment: Within 7 days
- Resolution timeline: Depends on severity, we'll keep you updated
The following are in scope for security reports:
- Smart Contracts: P&L Solana program (
plp_program/) - Web Application: Frontend and API routes
- Backend Services: Blockchain sync, Socket.IO server
- Third-party services (pump.fun, Privy, Helius, Jupiter, Pinata)
- Social engineering attacks
- DoS/DDoS attacks
- Issues already reported or known
We appreciate security researchers who help keep P&L safe. Responsible disclosures may be acknowledged in our documentation (with your permission).