Security Vulnerability Disclosure

Last updated: Oct 22, 2026

We take the security of SpendCrypto seriously. If you believe you have found a security vulnerability in our products or services, we want to hear from you.

This page describes our responsible disclosure process. We do not run a public bug bounty program, but we may offer a discretionary reward for confirmed critical (and, at our discretion, high-severity) issues.

Contact

Email security reports to security@spendcrypto.com.

Please use this address only for security vulnerabilities. For customer support, use support@spendcrypto.com or the Help Center.

Scope

In scope

Out of scope

  • Social engineering, phishing, or physical attacks against our staff, offices, or users
  • Denial of service (DoS/DDoS), volumetric attacks, or resource exhaustion
  • Spam, email bombing, or content injection without a security impact
  • Reports from automated scanners with no demonstrated impact
  • Missing security best practices (for example, missing headers) without a working exploit path
  • Self-XSS, clickjacking on non-sensitive pages, or logout CSRF without demonstrated impact
  • Vulnerabilities in third-party services, libraries, or providers we do not control
  • Issues that require unlikely or extreme user interaction
  • Previously reported, publicly known, or already fixed issues

We may update this scope at any time.

Rules for researchers

When testing and reporting, please:

  1. Act in good faith and avoid privacy violations, data destruction, and service disruption.
  2. Limit testing to the minimum needed to demonstrate the issue. Do not access, modify, or exfiltrate other users’ data beyond a proof of concept.
  3. Do not publicly disclose the vulnerability until we have confirmed a fix, or until we agree on a disclosure timeline with you.
  4. Do not demand payment as a condition of reporting or withholding a report.
  5. Comply with applicable laws.

Safe harbor

If you follow this policy in good faith, we will not pursue legal action against you for security research related to SpendCrypto, and we will treat your report as authorized testing under this policy. This safe harbor does not apply to actions outside the scope or rules above.

What to include in your report

Helpful reports typically include:

  • A clear description of the vulnerability and its potential impact
  • Affected URL, endpoint, app version, or component
  • Step-by-step reproduction instructions or a proof of concept
  • Any relevant screenshots, logs, or request/response samples (redact secrets where possible)
  • Your preferred contact method and handle for follow-up
  • Optional: suggested severity (Critical / High / Medium / Low)

Incomplete reports may take longer to triage or may be declined.

Our process

  1. Acknowledge — We aim to acknowledge receipt within 2 business days.
  2. Triage — We validate the report, assess severity, and determine whether it is in scope.
  3. Remediate — We work on a fix and may ask follow-up questions.
  4. Update — We will share status updates when there is meaningful progress.
  5. Close — Once fixed (or if out of scope / duplicate), we will let you know. With your permission, we may credit you.

We do not guarantee a specific fix timeline. Severity, complexity, and operational constraints affect how quickly we can ship a remediation.

Rewards

SpendCrypto does not operate a public bug bounty with fixed payouts or tiers.

For confirmed, in-scope critical vulnerabilities (and, at our sole discretion, certain high-severity issues), we may offer a discretionary reward. Whether a reward is offered, and in what amount or form, is decided solely by SpendCrypto.

Rewards are generally not provided for:

  • Out-of-scope findings
  • Duplicate reports (first valid report wins)
  • Issues with no realistic security impact
  • Reports that violate the rules above
  • Social engineering, DoS, or third-party issues

Submitting a report does not create a contract, entitlement, or obligation to pay.

Coordinated disclosure

We prefer coordinated disclosure. Please give us a reasonable opportunity to investigate and fix the issue before publishing any details. If you plan to disclose publicly, contact us first so we can agree on timing.

Questions

If you are unsure whether something is in scope, email security@spendcrypto.com with a high-level description (without exploiting anything further) and we will advise.