According to CoinMeta, Polygon Labs disclosed previously private security vulnerabilities in its proof-of-stake network, which have since been fixed after the Austin and Kyoto hard forks. The issues included a denial-of-service path in the Bor execution client and a carefully constructed transaction attack that could force Heimdall validators to perform costly processing. Polygon stated that no exploitation of these vulnerabilities on the mainnet was observed. What is more noteworthy is the timing of the disclosure; Polygon intentionally concealed technical details during the private distribution and testing of the patches in order to reduce the time attackers had to study the known vulnerabilities. According to a security review on August 27th, the changes for Austin and Kyoto were first privately launched and tested on the Amoy testnet, with detailed information being released after the network migrated to the patched version. Polygon reported that the denial-of-service issue in Austin and the vulnerability in Kyoto were not exploited on the mainnet before they were fixed.