Bug Bounty
Program

CoinHome understands the importance of security and keeping our users safe. Although our IT team has taken all precautions to find possible bugs in our system, there is always a slight possibility that a few of them could have been overlooked. At CoinHome we believe that working hand in hand with our community can bring the best results for both parties. CoinHome is running a bug bounty program under which you are entitled to a reward if you report a significant eligible bug.
Report Bug
Handshake

Responsible disclosure

Responsible disclosure includes, but is not limited to:
  • 1. Providing us a reasonable amount of time to fix the issue before publishing it elsewhere.
  • 2. Non violation of the privacy of other users, destroy any data or disrupt our services, etc. (act in good faith).
  • 3. Not defrauding CoinHome users (you do not interact with an individual account, which includes modifying or accessing data from the account) or CoinHome itself in the process of discovery.
  • 4. For exploits that need account access you must use your own account.
  • 5. If you inadvertently access private data, we ask that you delete all related information - including but not limited to access codes, private data, and etc., after notifying us.
  • 6. If, in the case of a bug, you were able to access and/or move funds from CoinHome, you commit to returning the whole amount to CoinHome.
* In order to encourage responsible disclosure, we will not bring legal action against researchers who point out a problem provided they do their best to follow the guidelines above.

How to report a bug

Send your bug report to support@coinhome.co.nz. A proof of the existing vulnerability (screenshots/video/script) is required. These files should not be shared publicly. This includes uploading to any publicly accessible websites (i.e. YouTube, Imgur, etc.).

Reproductional steps must be provided in the bug report including:
  • - URL and affected parameters
  • - Description of the browser (type), OS, device and/or app version
  • - Description of the perceived impact of the vulnerability
  • - Suggestions on how to solve the issue (optional)
Report Bug
* If our IT team cannot reproduce and verify the issue, the bounty will not be allocated.
* Include your BTC/ETH address for payment.
Mail icon

Eligibility (Scope)

All services provided by CoinHome are eligible for our bug bounty program, including the iOS and Android CoinHome apps, CoinHome Wallet, API, Merchant Tools, Cards and Exchange.
In general, vulnerabilities that have a potential for financial loss or data breach, are considered of sufficient severity, including but not necessarily:
  • - Cross-Site Request Forgery (CSRF)
  • - Cross-Site Scripting (XSS)
  • - Code Injection
  • - Remote Code Execution
  • - Privilege Escalation
  • - Authentication Bypass
  • - Clickjacking
  • - Leakage of Sensitive Data

Ineligibility (Out of Scope)

In general, the following vulnerabilities will not meet the severity threshold:
  • - Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website
  • - Password complexity requirements
  • - Self-XSS
  • - Denial of service (DoS)
  • - Spamming
  • - Usability issues
  • - Vulnerabilities affecting outdated or unpatched browsers
  • - Vulnerabilities in third party applications which make use of the CoinHome API
  • - Reports from automated tools or scans, without exploitability demonstration
  • - Non-technical attacks, such as physical attack, social engineering, phishing, etc.
  • - Bugs that have been already reported before
  • - Bugs known to us
  • - Non-reproducible issues

Help to keep CoinHome and our users safe

Report Bug
cookies banner
We value your privacy
We and our partners use technology such as cookies on our site to ensure website functionality and safety, and analyze our traffic. Click below to consent to the use of this technology. For more information about it, please visit our Cookie Policy.