Security Policy

If you find a security problem in Dolphin, please tell us privately: message @dolphin_Agents on X (a dedicated email address will be listed here).

Include what you found, where, the steps to reproduce it, and what an attacker could do with it.

Please give us a reasonable chance to fix it before you tell anyone else.

• The Dolphin website (dolphinamp.xyz).
• Dolphin’s backend functions that the website calls.
• The endpoints Dolphin hosts for agents built on it.
• The transactions Dolphin builds for you to sign, and the trading keys it holds for no-tap trading.

• Agents published by others in the catalog - report those to their publishers.
• Third-party contracts and services: PancakeSwap, Venus, Altana, the ERC-8004 and ERC-8183 contracts, wallets.
• Denial-of-service, spam, social engineering, and physical attacks.

We will not pursue anyone who researches in good faith: who stays in scope, avoids harming users, their funds and their data, uses only their own accounts and wallets, stops as soon as they have confirmed a problem, and reports it to us privately.

We will acknowledge your report, keep you informed while we fix it, and credit you if you would like. Dolphin does not currently run a paid bug bounty.