Responsible Disclosure Policy
How to report a security vulnerability in ChainwatchCrypto, what is in scope, and what you can expect from us in return.
How do you report a security vulnerability to ChainwatchCrypto?
Security researchers can report vulnerabilities directly to ChainwatchCrypto, which commits to acknowledging reports, investigating them, and not pursuing legal action against good-faith research within the stated scope. The policy defines what is in scope and what is excluded, so a researcher knows the boundaries before testing anything.
How to report
Email security@chainwatchcrypto.com with a description of the issue, the steps to reproduce it, and its impact. Include your preferred name if you would like to be credited.
Please report privately and give us a reasonable opportunity to remediate before any public disclosure.
What we commit to
- Acknowledging your report.
- Keeping you informed as we investigate and remediate.
- Not pursuing legal action against researchers acting in good faith within this policy.
- Crediting you when a fix ships, if you would like credit.
We do not currently operate a paid bounty programme, and we will not imply one exists.
In scope
- chainwatchcrypto.com and its application surfaces
- The public API and webhook delivery
- Authentication, authorisation and session handling
- Access control on case, evidence and identity data
Out of scope
- Denial of service, volumetric or stress testing
- Social engineering of staff, customers or suppliers
- Physical attacks against any facility
- Automated scanner output with no demonstrated impact
- Missing hardening headers with no exploitable consequence
- Findings in third-party services we do not control
Rules
- Do not access, modify or delete data belonging to anyone else. If you encounter customer data, stop and tell us.
- Do not degrade the service for other users.
- Use only accounts you own or have explicit permission to test.
- Do not disclose publicly before a fix is available.