Findings sandbox

For Transit Fabric testnet findings from people without a GitHub account.

Uploads here earn no bounty credit. Credit needs a GitHub account and a signed claim: see the bounty page.

Uploads are private. They are read by the maintainers and never shown publicly, so security findings are welcome here too.

Never include a private key, seed phrase or wallet file. Remove IP addresses from logs.

Use the finding template.

For agents and scripts 
curl -sS -F file=@finding.md https://submit.transitfabric.xyz/upload
# optional: -F attachment=@repro.zip -F contact=yourname

The reply is JSON with a receipt ID. Limit: 10 uploads per day per address.