Acinq Vulnerability Disclosure

generated: '2026-08-17'
method: searched
probe: true
source: https://github.com/ACINQ/eclair/blob/master/SECURITY.md
notes: >-
  ACINQ DOES run a real vulnerability-disclosure process — but it is published only in
  the SECURITY.md files of its GitHub repositories, not on its websites. This is why the
  automated probe (probe-security-programs.py) reported vdp=none: it checks
  /.well-known/security.txt and the /security, /responsible-disclosure and
  /vulnerability-disclosure web paths, and acinq.co returns 404 for all of them while
  phoenix.acinq.co returns a 403 SPA shell.

  Confirmed by fetch, 2026-08-17: a named security contact, three maintainer PGP keys
  with published fingerprints, and the key material served from ACINQ's own domain at
  https://acinq.co/pgp/*.asc (HTTP 200 on all three). That is a stronger disclosure
  posture than the probe suggests, and it is genuinely verified — hence method: searched
  with `type: Security` wired in apis.yml pointing at the policy.

  The remaining gap is discoverability, not intent: a two-line /.well-known/security.txt
  on acinq.co pointing at the same contact and policy would make this machine-findable.
policy:
- https://github.com/ACINQ/eclair/blob/master/SECURITY.md
- https://github.com/ACINQ/lightning-kmp/blob/master/SECURITY.md
- https://github.com/ACINQ/bitcoin-kmp/blob/master/SECURITY.md
contact:
- security@acinq.fr
contact_note: >-
  Quoted verbatim from SECURITY.md: 'To report security issues send an email to
  security@acinq.fr (not for support).'
encryption:
  supported: true
  method: PGP
  key_hosting_domain: acinq.co
  keys:
  - name: Pierre-Marie Padiou
    fingerprint: 6AA4 5A4C 209A 2D30 64CF 66BE E434 ED29 2E85 643A
    key_url: https://acinq.co/pgp/padioupm.asc
    key_url_status: 200
  - name: Fabrice Drouin
    fingerprint: C25A 288A 842E AF7A A5B5 303F 7A73 FE77 DE2C 4027
    key_url: https://acinq.co/pgp/drouinf.asc
    key_url_status: 200
  - name: Bastien Teinturier
    fingerprint: 72BD 8AD9 F656 1619 37FA 8A5D 34F3 77B0 100E D6BB
    key_url: https://acinq.co/pgp/tbast.asc
    key_url_status: 200
bug_bounty:
  program: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  note: No bug bounty programme found on any platform or in any ACINQ documentation.
security_advisories:
  github_advisories: true
  note: >-
    ACINQ has published security tooling in response to real incidents — for example
    ACINQ/detection-tool-cve-2019-13000, 'A tool that detect if your node has been victim
    of the invalid funding tx attack' — which evidences a working incident-response
    practice alongside the disclosure contact.
  example: https://github.com/ACINQ/detection-tool-cve-2019-13000
security_txt:
  served: false
  hosts_probed:
  - {url: 'https://acinq.co/.well-known/security.txt', status: 404}
  - {url: 'https://phoenix.acinq.co/.well-known/security.txt', status: 403, note: SPA shell, not a document}
  ref: well-known/acinq-well-known.yml
api_security_guidance:
  note: >-
    Both API references carry an explicit, prominent warning that the API grants access to
    funds and must not be reachable from the internet — phoenixd's reference opens its
    Security section with it, and eclair's docs/API.md compares the exposure risk to the
    Bitcoin Core RPC. Recorded because it is real, published security guidance for API
    consumers, which most providers omit.
  sources:
  - https://phoenix.acinq.co/server/api
  - https://github.com/ACINQ/eclair/blob/master/docs/API.md
evidence:
- {source: 'https://github.com/ACINQ/eclair/blob/master/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-08-17'}
- {source: 'https://raw.githubusercontent.com/ACINQ/lightning-kmp/master/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-08-17'}
- {source: 'https://raw.githubusercontent.com/ACINQ/bitcoin-kmp/master/SECURITY.md', kind: security-policy, http_status: 200, fetched: '2026-08-17'}
- {source: 'https://acinq.co/pgp/tbast.asc', kind: pgp-key, http_status: 200, fetched: '2026-08-17'}
- {source: 'https://acinq.co/pgp/drouinf.asc', kind: pgp-key, http_status: 200, fetched: '2026-08-17'}
- {source: 'https://acinq.co/pgp/padioupm.asc', kind: pgp-key, http_status: 200, fetched: '2026-08-17'}