Cardano security and incident response

Intersect facilitates Cardano's incident response capability through a structured framework of policies, roles, and processes maintained by its Security Council.

Intersect, in conjunction with its steering committees and executive, appoints the Security Council, which reports to the Technical Steering Committee. The Security Council oversees a security policy on behalf of ecosystem, manages incident response, and coordinates with contributing organizations when issues arise, across the repositories under its stewardship. It operates through a defined set of roles: a Security Manager who receives and triages reports, Responders who are the directly responsible individuals for resolving specific issues, and Insiders — vetted contributors granted access to sensitive information on a need-to-know basis. This structure is designed to contain sensitive information while enabling a fast, coordinated technical response.

Intersect also operates a Bug Bounty Program to encourage responsible disclosure of vulnerabilities before they can cause harm.

For extreme scenarios, Intersect's Security Council will invoke CIP-135, Cardano's formal disaster recovery framework. CIP-135 defines procedures for situations where the protocol's built-in recovery mechanisms are insufficient. The framework is exercised regularly through fire drills on the SanchoNet testnet. It was held on standby during the November 2025 chain partition incident. However, it was not needed, as the network recovered through coordinated node upgrades.