V VaultFi
SECURITY

Help us keep VaultFi secure.

VaultFi welcomes responsible security research. If you believe you have discovered a vulnerability affecting VaultFi, its wallet interfaces, authentication, transaction flows or supporting infrastructure, please report it privately through the form on this page.

Report privately

Do not publish an unresolved vulnerability, customer information, credentials or exploit details before VaultFi has had a reasonable opportunity to investigate.

Protect customer funds

Security research must never intentionally move, destroy, lock or expose another user's digital assets or account information.

Good-faith research

Keep testing proportionate, use your own accounts where possible and stop immediately if you encounter private information belonging to another person.

Responsible disclosure policy

VaultFi appreciates security researchers who help identify weaknesses before they can be abused. Reports should contain enough information for our team to reproduce and evaluate the issue.

Good-faith security research
  • Test using accounts and assets you control.
  • Minimize access to data that is not yours.
  • Stop testing if your activity could damage customer funds or service availability.
  • Report the vulnerability promptly and confidentially.
  • Give VaultFi reasonable time to investigate and remediate before public disclosure.
  • Preserve evidence without retaining unnecessary customer information.
Please do not
  • steal, transfer, lock or destroy digital assets;
  • obtain or retain another user's private information beyond what is unavoidable to demonstrate the issue;
  • perform denial-of-service or resource-exhaustion attacks;
  • send spam, phishing messages or malware;
  • use social engineering against VaultFi users, employees or providers;
  • publicly disclose an unresolved issue in a way that creates unnecessary risk to users.

What to include

A useful report normally contains the affected VaultFi page or service, the security impact, reproducible steps, expected versus actual behavior, and any supporting request/response information that does not expose private keys or unrelated customer data.

Never submit private keys, seed phrases, authentication secrets, passwords or other credentials through this form.

Submit a vulnerability report

A VaultFi account is not required. Contact information is optional, although providing an email gives VaultFi a way to request additional technical information.

Scope

Reports may concern the VaultFi website, customer account interfaces, authentication and session security, wallet integration, transaction flows, APIs and other VaultFi-controlled application components.

Independent blockchain networks, third-party protocols and external providers may operate their own vulnerability-disclosure programs. VaultFi may coordinate with those providers when a valid report affects an integration.