> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Cantina Community Code of Conduct

> Standards of conduct for Researchers, Sponsors, and Triagers on the Cantina platform.

Effective date: October 22, 2026 · Version 1.0

This Code of Conduct applies to all users of the Cantina platform ("Cantina Code"), including Researchers, Sponsors, and Triagers, across all engagement types - bug bounties, competitions, and security reviews. It supplements the [General Terms of Use](https://cantina.xyz/terms/general), any engagement-specific terms, and the Cantina documentation; where those impose stricter obligations, the stricter obligation applies. For Sponsors, a signed agreement with Cantina (such as a master services agreement) controls over this Code if the two conflict. By using the platform, you agree to follow this Code of Conduct.

## 1. Professionalism and Respect

* Act in good faith and treat all community members - Researchers, Sponsors, Triagers, and Cantina staff - with professionalism, integrity, and respect.
* Harassment, hate speech, discrimination, personal attacks, doxxing, threats, or intimidation are not tolerated in any form, on or off the platform, when directed at members of the Cantina community.
* Disagreement with a triage decision, severity assessment, or reward is expected and acceptable; abusive, excessive, or bad-faith communication about it is not. Use the dispute process (Section 7), not pressure. In bug bounties, the Sponsor's decision on severity and reward is final.

## 2. Submission Integrity

* Submit only work that is your own. Plagiarizing another researcher's finding, in whole or in part, is grounds for immediate removal from the platform.
* Do not falsify, exaggerate, or misrepresent vulnerability reports, including misrepresenting severity, impact, or assets in scope.
* Do not submit spam, placeholder reports, the same finding more than once within a program, or large volumes of low-signal, non-actionable reports, including unverified output of automated scanners or AI tools submitted without meaningful validation and reproduction steps.
* Do not farm reputation through duplicate accounts, collusion, or coordinated submissions designed to game rankings, judging, or reward allocation.
* Some programs require a submission deposit. Deposits are returned for valid submissions and good-faith submissions that are rejected, and are forfeited for spam, low-effort or unverified AI-generated submissions, or clearly inflated severity claims, as set out in the program's terms.
* **Conflicts of interest.** Do not take part in an engagement for a Sponsor that employs you, pays you, or has given you non-public access to its code, unless you tell Cantina first and Cantina approves. Triagers and judges may not submit findings to engagements they triage or judge. Cantina staff and contractors with access to non-public information about an engagement may not take part in it as Researchers.

## 3. Responsible Testing

* Test only assets explicitly in scope, as defined in the engagement's outline or scope documents.
* Never test against mainnet or public testnet contracts, pricing oracles, third-party smart contracts, or third-party systems unless the program explicitly authorizes it.
* Do not use denial of service, resource exhaustion, spamming, or other techniques that may degrade the integrity, availability, or reliability of in-scope code, the platform, or any third party. Stop immediately if your testing causes unexpected degradation.
* Do not use social engineering or phishing against Sponsors, their employees, other Researchers, or Cantina.
* Never exploit a vulnerability beyond the minimum needed to demonstrate impact, and never access, modify, exfiltrate, or retain user funds or data beyond a minimal proof of concept. "Rescuing" funds without the Sponsor's express written consent is prohibited.
* If a Sponsor has adopted a safe harbor agreement for its program (such as SEAL Safe Harbor), acting within that agreement's terms counts as the Sponsor's consent. Cantina is not a party to safe harbor agreements and is not responsible for them; you are responsible for understanding their terms.
* If you encounter personal information about anyone, access only what is needed to demonstrate the issue, do not copy, keep or disclose it, delete it after reporting, and say in your submission that you encountered it.

## 4. Keep All Communication On-Platform

Keep all discussion of your submitted findings on Cantina.

Contacting program clients (Sponsors) or their employees outside of the platform goes against our community guidelines and will lead to finding rejection, loss of rewards, and potential account suspension.

This means:

* Submit findings only through Cantina Code - never by email, social media, direct message, or any other channel.
* Discuss a submission, its status, severity, or reward only in the submission's thread on the platform, or with Cantina support.
* Do not contact a Sponsor or its employees off-platform about an engagement, a finding, a reward, or follow-on work, and do not solicit or accept off-platform payment for work connected to a Cantina engagement.
* If a Sponsor contacts you off-platform about an engagement, a finding or a reward, don't engage. Report it to Cantina support.
* Sponsors likewise agree not to solicit Researchers off-platform or settle rewards outside Cantina.
* Agreements or payments made off-platform for work connected to a Cantina engagement have no standing on Cantina.

Keeping communication on the platform keeps every engagement secure and in one place.

## 5. Confidentiality and Disclosure

* All non-public information about an engagement - code, findings, submissions, communications, and the existence of a private engagement itself - is confidential, as set out in the applicable terms.
* Do not publicly disclose a finding, or the existence of a finding, before it has been fixed and the Sponsor has given prior written consent, regardless of its status or reward outcome.
* Do not post screenshots or excerpts of submissions, triage conversations, or private program details to social media, chat groups, or anywhere else.
* Use AI or other third-party tools with confidential engagement information only if the tool does not keep it to train models and does not share it with others. You remain responsible for how your tools handle it.
* Threatening disclosure to gain leverage over a reward or triage decision is extortion and is treated with zero tolerance (Section 6).

## 6. Zero-Tolerance Violations

The following result in immediate permanent removal from the platform and forfeiture of pending rewards, and may be referred to law enforcement:

* Extortion, blackmail, or threatening disclosure or exploitation of a vulnerability for leverage.
* Exploiting a vulnerability for personal gain or malicious intent.
* Theft or unauthorized retention of funds or data.
* Submitting findings while subject to sanctions, or circumventing KYC or jurisdiction restrictions.
* Evading a prior suspension or ban through a new or alternate account.
* Submitting falsified tax or identity documents, or documents belonging to another person or entity unless you are authorized to submit them on its behalf.

## 7. Account Integrity and Disputes

* One person, one account. Do not create multiple accounts, share accounts, or impersonate any person or entity, including Cantina staff. The KYC identity and tax form on an account must belong to the same person or entity that receives its payouts.
* Provide accurate and timely KYC information when required.
* Submit the appropriate completed, signed tax form and keep your identity verification and tax information up to date. Payouts are held while these requirements are incomplete. A hold caused by missing tax information does not, by itself, cancel your payout. Once the requirements are complete, payouts remain subject to the applicable payment terms and schedule.
* If you believe a decision is wrong, raise a good-faith dispute through the platform or via the support portal at [support.cantina.security](https://support.cantina.security). Report suspected Code of Conduct violations the same way; reports are handled confidentially, and retaliation against good-faith reporters is itself a violation.

## 8. Enforcement

Cantina reserves sole discretion to determine whether conduct violates this Code. Depending on severity and history, consequences may include: a warning, rejection of the affected finding, forfeiture of rewards, temporary suspension, or permanent removal from the platform. Zero-tolerance violations (Section 6) skip the ladder. Enforcement under this Code does not limit Cantina's rights under the General Terms of Use or any engagement-specific terms.

**Appeals:** You can appeal an enforcement decision once, within 14 days of being notified, through the support portal at [support.cantina.security](https://support.cantina.security). Include your account, the decision, and why you believe it's wrong. A Cantina team member will review the appeal and respond within 10 business days. Their decision is final. Appeals cover Cantina's enforcement decisions only and do not reopen a Sponsor's decision on severity or reward. Zero-tolerance removals (Section 6) can be appealed only on the grounds of mistaken identity or a factual error.

**Changes to this Code:** Cantina may update this Code of Conduct. The current version and its effective date are always published here, and significant changes are announced to the community. Continuing to use the platform after an update means you accept the current version.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.