Security at Summus

Security lead

Francesco Pio Iacobucci, Head of Security, Summus World LLC. Leads security for Summus products and handles every vulnerability report.

Scope

• Summus App: app.summus.life
• Summus Network area and API: network.summus.life and the backend API
• NATURA dApp: terramaternfts.com, and the NATURA smart contracts

Out of scope: reports produced only by an automated scanner with no demonstrated impact; missing hardening headers with no exploitable consequence; vulnerabilities in third-party services we only use (please report those to their vendors).

What we ask of you

• Do not access, modify or delete data that is not yours. If you reach someone else's data by accident, stop and tell us what you saw, without keeping a copy.
• No denial-of-service tests, spam or social engineering against our staff or users.
• Test only with your own accounts. Ask us for a test account if you need one.
• Contact us before any on-chain experiment, testnets included.
• Give us reasonable time to fix the issue before any public disclosure.

What you can expect from us

• A first reply within 5 working days.
• An assessment of severity and an indication of when we expect to fix it.
• Credit, if you want it, once the issue is fixed.
• We do not pay bug bounties. We say so upfront so that nobody spends time expecting one.

Safe harbor

We will not pursue legal action against anyone who follows this policy in good faith, keeps the report confidential until a fix is released, and avoids harming our users or their data.