RESPONSIBLE DISCLOSURE

Bug Bounty Program

Help us build the most secure trading infrastructure. Report vulnerabilities responsibly and get rewarded.

Max Reward

$25,000

Critical RCE

Response Time

24 Hours

Initial Ack

Triage Time

72 Hours

Severity Assessment

Resolution

7 Days

Target Timeline

01. Scope

In Scope

Sentinel Core (TEE)
Hardware enclave, attestation proofs, signing logic
Policy Engine
Mission constraints, drawdown limits, rule evaluation
Venue Adapters
Binance, Bybit, and other exchange integrations
Web Applications
zerocopy.systems, Command Center API, auth flows
Cryptographic Protocols
ECDSA, key derivation, signature validation
Infrastructure
AWS Nitro isolation, vsock communication

Out of Scope

Social Engineering
Phishing, pretexting, physical access
Distributed Denial of Service
DDoS attacks on any systems
Third-Party Services
AWS, GitHub, Cloudflare, other vendors
Speculative Vulnerabilities
Theoretical bugs without proof of concept
Information Disclosure
Company details, team info, business plans
Zero-Day Policies
Non-standard responsible disclosure agreements

02. Severity Levels & Rewards

Critical

Reward: $5,000 - $25,000

Examples:

•Remote Code Execution (RCE)
•Private key extraction
•Attestation proof forgery
•Policy engine bypass
•Unauthorized transaction signing

High

Reward: $2,000 - $10,000

Examples:

•Authentication bypass
•Authorization bypass
•Policy circumvention
•Data integrity violation
•Cryptographic implementation flaw

Medium

Reward: $500 - $2,000

Examples:

•Cross-Site Request Forgery (CSRF)
•Information disclosure
•Race condition vulnerability
•Timing attack
•Resource exhaustion

Low

Reward: $100 - $500

Examples:

•Minor security misconfigurations
•Deprecated dependency usage
•Non-critical information leaks
•Client-side validation bypass

03. How to Report

1. Send a Detailed Report

Email your vulnerability report to [email protected]

Include:

Vulnerability type & severity assessment
Affected component (enclave, policy, adapter, etc.)
Steps to reproduce (detailed and specific)
Proof of concept code (if applicable)
Potential impact & exploitation difficulty
Your contact info & GPG key (optional)

2. We Acknowledge & Triage

Within 24 hours: We'll acknowledge receipt of your report
Within 72 hours: We'll triage severity and begin reproduction
Keep you updated: Regular updates on progress and timeline

3. Resolution & Reward

Patch Development: We'll develop and test a fix (typically <1 week)
Verification: You'll have the chance to verify the fix before public disclosure
Reward: Payment via wire transfer or crypto (your choice)
Attribution: Optional mention in security advisory

04. Safe Harbor

We commit to the following:

We will not pursue legal action against researchers acting in good faith
We will not refer researchers to law enforcement for responsible disclosure
We consider authorized security research a legitimate activity
We will provide a 90-day disclosure window before public release

05. Hall of Fame

Recognition coming soon as we receive reports.

Found a vulnerability?

Report it securely and responsibly. We reward good faith disclosure.

Report a Bug

Additional Resources

Security & Compliance

View our threat model, audits, and compliance status.

Research & Docs

Read our whitepapers and technical documentation.

Contact Us

Get in touch for enterprise security inquiries.

01. Scope

In Scope

Sentinel Core (TEE)
Hardware enclave, attestation proofs, signing logic
Policy Engine
Mission constraints, drawdown limits, rule evaluation
Venue Adapters
Binance, Bybit, and other exchange integrations
Web Applications
zerocopy.systems, Command Center API, auth flows
Cryptographic Protocols
ECDSA, key derivation, signature validation
Infrastructure
AWS Nitro isolation, vsock communication

Out of Scope

Social Engineering
Phishing, pretexting, physical access
Distributed Denial of Service
DDoS attacks on any systems
Third-Party Services
AWS, GitHub, Cloudflare, other vendors
Speculative Vulnerabilities
Theoretical bugs without proof of concept
Information Disclosure
Company details, team info, business plans
Zero-Day Policies
Non-standard responsible disclosure agreements

02. Severity Levels & Rewards

Critical

Reward: $5,000 - $25,000

Examples:

•Remote Code Execution (RCE)
•Private key extraction
•Attestation proof forgery
•Policy engine bypass
•Unauthorized transaction signing

High

Reward: $2,000 - $10,000

Examples:

•Authentication bypass
•Authorization bypass
•Policy circumvention
•Data integrity violation
•Cryptographic implementation flaw

Medium

Reward: $500 - $2,000

Examples:

•Cross-Site Request Forgery (CSRF)
•Information disclosure
•Race condition vulnerability
•Timing attack
•Resource exhaustion

Low

Reward: $100 - $500

Examples:

•Minor security misconfigurations
•Deprecated dependency usage
•Non-critical information leaks
•Client-side validation bypass

03. How to Report

1. Send a Detailed Report

Email your vulnerability report to [email protected]

Include:

Vulnerability type & severity assessment
Affected component (enclave, policy, adapter, etc.)
Steps to reproduce (detailed and specific)
Proof of concept code (if applicable)
Potential impact & exploitation difficulty
Your contact info & GPG key (optional)

2. We Acknowledge & Triage

Within 24 hours: We'll acknowledge receipt of your report
Within 72 hours: We'll triage severity and begin reproduction
Keep you updated: Regular updates on progress and timeline

3. Resolution & Reward

Patch Development: We'll develop and test a fix (typically <1 week)
Verification: You'll have the chance to verify the fix before public disclosure
Reward: Payment via wire transfer or crypto (your choice)
Attribution: Optional mention in security advisory

04. Safe Harbor

We commit to the following:

We will not pursue legal action against researchers acting in good faith
We will not refer researchers to law enforcement for responsible disclosure
We consider authorized security research a legitimate activity
We will provide a 90-day disclosure window before public release