Coordination for cybersecurity

Coordination is on for cybersecurity. Saw something unsafe, a site, a protocol, a system, a scam, a door that should be closed? Say it in plain words. It becomes the right next work: a disclosure to the owner, a verification review, a fix, each step moved by the person with authority, proved and anchored. Nothing is tested without permission.

Bring what looks unsafe. It becomes the right next work.

This page is for anyone who noticed something unsafe online and wants it to reach the person who can fix it. Vealth coordinates the steps. It does not scan anyone, break into anything or test a system, and it asserts no verdict.

Report something about Vealth Post a need

Three steps

Each step moves only when the right person says so.

1. Say it plainly: What you saw, where, and why it looks unsafe. No exploit and no test are needed: a description is enough to start, and a description is all we ask for.
2. Reach the owner: The right next work is usually a disclosure to whoever runs the system, through the channel they publish. A verification review reads only what is published, never what sits behind a login or a wall. A fix is always the owner's.
3. Prove and anchor: Each step is moved by the person with authority over it. A finding is hashed and anchored on Base before it leaves our hands, so the date it existed can be checked without trusting us.

If it is happening now

An attack in progress goes to the people who can stop it.

An active crypto incident: Go to the affected protocol's own emergency channel and to SEAL 911, the security community's emergency line for live crypto incidents.
A crime: Go to law enforcement.
What Vealth does: Vealth is not a 24/7 responder. It coordinates and accounts for authorized work afterwards: the disclosure, the review, the fix, each proved and anchored.

Where to bring it

Pick the door that fits.

About Vealth itself: Anything about vealth.net, its API or the Ecological Work Protocol contracts goes to the security disclosure page, the plain version of our security.txt. One person reads every report.
A place or a system you rely on: Use Post a need and say it in plain words. Post only work you have authority to propose; a need is not permission to test anything.
If you use an AI: Connect it to https://vealth.net/mcp. It asks for the work with prepare_request, signed by your own wallet, and reads the live figures below with beacon.

What this never does

White hat only.

No scanning: Vealth does not scan anyone's systems, and it does not run tools against a site to look for weaknesses.
No testing without permission: Nothing is tested without the owner's written permission, and then only on the paths they invite.
No verdicts: A review says what it read and how anyone can check it again. It does not certify that a system is safe.
No outreach: Vealth answers what is brought to it. It does not contact anyone uninvited.

Our own light, live

The light says whether this door is ready. It is never a verdict on anyone's security, ours included.

The light: —. It is on while both conditions below hold, off when one does not, and unknown when a file could not be read.
Safety manifest reviewed: —, — days ago. Ready when our safety manifest was reviewed in the last 14 days, never a date in the future: —.
security.txt expires: —. Ready while it has not expired: —.
Disclosures: — received, — answered
Reviews: — done: — with a hash recorded, — submitted, — confirmed on Base by our registry, — with the evidence still matching

Counts only: the register behind these numbers never names who reported anything, and a count under 3 reads "under 3". A review counts as anchored only when our registry confirms its hash on Base. Read the same figures at /labor/beacon, and every coordination move as it happens in the coordination feed.