Security
Security and responsible disclosure
To report a security vulnerability in a Stablecorp website or service, email security@stablecorp.ca.
QCAD, the Canadian dollar stablecoin, is issued by QCAD Digital Trust (the “Trust”). Stablecorp Digital Currencies Inc. is the Trust’s administrator and servicing agent. Reports from security researchers help us keep QCAD, our systems and the people who use them safe, and we welcome them.
How to report
Please include, where you can:
- A clear description of the issue and where you found it.
- The steps needed to reproduce it.
- The potential impact as you see it.
- Any proof-of-concept material, and how you would like to be credited.
If the issue is urgent, or the details are sensitive, start the subject line with “URGENT” and send a short summary without working exploit code. We will reply to agree on a secure way to share the details.
We will confirm receipt, keep you updated as we investigate, and tell you when the issue is resolved.
What we ask of you
So that we can treat your work as good-faith research, please:
- Test only against your own accounts and test data. Do not access, modify or delete data that is not yours.
- Stop as soon as you encounter personal or confidential data, and tell us rather than exploring further.
- Avoid anything that degrades or disrupts our services, including denial-of-service testing, spam, and social engineering of our staff, customers or partners.
- Do not attempt to move, drain or manipulate funds or on-chain assets, and do not run exploits against deployed contracts. Reviewing the public QCAD smart contracts and reporting what you find is welcome.
- Give us a reasonable opportunity to fix an issue before you disclose it publicly.
Our commitment to you
If you make a good-faith effort to follow this policy while testing systems in scope, Stablecorp Digital Currencies Inc., the administrator and servicing agent of QCAD Digital Trust, and its affiliates (“Stablecorp”) will consider your research authorized, will work with you to understand and fix the issue, and will not initiate legal action against you for it. If a third party brings legal action against you for research that we determine followed this policy, we will make that determination known.
This policy cannot authorize testing of systems that Stablecorp does not own or operate, and it does not bind any third party.
We do not currently offer monetary rewards. With your permission, we are glad to acknowledge researchers who report valid issues.
Scope
In scope: stablecorp.ca and its subdomains, other websites and APIs that Stablecorp operates, and the QCAD smart contracts, for review and reporting only as described above.
Out of scope: systems operated by third parties, including exchanges, wallets and other service providers. Please report issues in those systems to the provider. If you are not sure whether something is in scope, email us before you test.
A note for the public
Stablecorp will never ask you for a private key or a seed phrase, for any reason. We will never ask for a password or a two-factor code by email, phone, text message or social media; enter those only on Stablecorp’s own sign-in pages. Anyone who asks otherwise is not us. If you receive a message like that, do not respond, and let us know at security@stablecorp.ca.
Machine-readable contact details are in our security.txt.