Disclosure SLA public
A response & disclosure hygiene factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor records whether the protocol publishes an acknowledgment-time service level agreement for disclosed vulnerabilities — for example, a commitment to acknowledge security reports within 72 hours, triage within seven days, and patch within 90 days. Measurement is manual curator review of the protocol's security disclosure documentation, bug bounty program terms, and any published responsible-disclosure policy. Category 13 context: a published SLA transforms an informal disclosure process into a contractual commitment, creating accountability for timely response and reducing the window between discovery and exploitation.
**Why it matters** The absence of a disclosure SLA is documented across multiple dataset incidents where known vulnerabilities were reported but not acted upon. Atomic Wallet ($100M, 2023) received a Least Authority security report in 2022 and failed to act — a public SLA would have created a documented timeline for mandatory response. Mango Markets ($115M, 2022) had a Discord warning in March 2022 referencing the exact vulnerability class; without a disclosure SLA, the warning disappeared without a response commitment. Sonne Finance ($20M, 2024) had a yAudit finding flagging the Compound V2 donation risk but the governance execution gap was not addressed within any defined timeframe. A published SLA does not prevent exploitation but creates a measurable standard against which team responsiveness can be assessed.
**Green / Yellow / Red** Green is scored when the protocol publishes a clear acknowledgment SLA of 72 hours or shorter, with a defined triage window and a maximum response timeline. Yellow applies when a partial SLA exists — for instance, the bug bounty program defines payment terms but not acknowledgment timelines. Red is scored when the protocol has an Immunefi program or equivalent but no acknowledgment SLA is published, or when the documented response history shows SLA violations on prior reports.
**Common gray cases** Gray applies when the protocol operates a private disclosure process and SLA terms are communicated only to submitters after first contact, making public verification impossible.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether the protocol publishes an acknowledgment-time SLA for disclosed vulnerabilities (e.g., 72h ack).