# Security policy · Coldfront

Source: https://cold-front.xyz/security-policy/
Updated: 11 October 2026

Last updated: 28 September 2026

## Reporting a vulnerability

Email **security@cold-front.xyz**. Please include what you found, the steps to reproduce it, and the version of the Extension.

- We reply within 3 working days.
- We aim to fix critical issues within 14 days and will tell you when a fix ships.
- We credit you in the release notes if you want.
- Please give us reasonable time to fix an issue before you publish it, and don't access other people's data or funds while testing.

## In scope

- The Coldfront Extension (ID ijhlfmhnpbgknhabconhepgdaabaeogg), for example: ways to read the API key while locked, to keep a session alive after a lock, or to get the API key from a page other than app.hyperliquid.xyz.
- cold-front.xyz.

## Out of scope

- Hyperliquid's app, API or blockchain: report those to Hyperliquid.
- Attacks that need malware already running on the user's computer, or an unlocked computer in the attacker's hands.
- Social engineering of our team.

## Safe harbour

We will not take legal action against good-faith research that follows this policy.