Vulnerability Disclosure

Vulnerability disclosure policy

We take the security of our public website and systems seriously. If you found a security issue, thank you for reporting it responsibly.

Scope

This policy covers the public website cryptorecovers.com and its directly related infrastructure. Research is welcome within the boundaries below. Anything outside this scope, including the systems of our clients, partners or hosting providers, is not covered by this policy.

Permitted research

You may test the public website for vulnerabilities using reasonable, non-destructive techniques: checking for common misconfigurations, testing input handling, and reviewing publicly served files. You may not access, attempt to access, or alter any system, account, database, wallet material or personal data other than your own test data.

How to report

Send your report to security@cryptorecovers.com. If you can, encrypt it with our PGP public key (see the PGP page); the fingerprint is published there. Do not publish the vulnerability publicly before we have had a reasonable chance to respond and fix it.

What to include in your report

A clear description of the issue and where it occurs; the steps to reproduce it, in enough detail for us to verify it; the potential impact you identified; your contact details (optional but useful); and confirmation that you only used your own test data.

What we commit to

We will acknowledge receipt of your report within five business days, keep you informed of progress, and work with you to verify and fix the issue. We will not take legal action against researchers who report in good faith and follow this policy.

Prohibited testing

Do not perform destructive or disruptive testing: no denial-of-service attacks, no data destruction or alteration, no credential stuffing, no phishing or social engineering of our team or clients, and no testing that could expose or exfiltrate wallet material or personal data. Do not exploit a vulnerability beyond what is necessary to demonstrate it.

Privacy

Reports are treated confidentially. We use the information only to verify, triage and fix the issue, and to communicate with you about it. We never ask you for wallet material, and you should never send us any.

Rewards

We do not currently operate a bug bounty program and do not offer financial rewards. We are grateful for responsible reports and will credit researchers publicly only with their explicit consent.