Skip to main content

🚨 Vulnerability Reporting

Learn how to report security vulnerabilities, understand our responsible disclosure policy, and contribute to SuperSafe's security.

Responsible Disclosure Policy​

SuperSafe Wallet takes security seriously and encourages responsible disclosure of security vulnerabilities. We appreciate the security research community's efforts to help keep our users safe.

Our Commitment​

Security First​

  • User Safety: User safety is our top priority
  • Quick Response: We respond to security reports quickly
  • Transparent Process: We maintain a transparent process
  • Recognition: We recognize security researchers

Response Timeline​

Security Response Timeline:
├── Initial Response: Within 24 hours
├── Triage: Within 48 hours
├── Investigation: Within 7 days
├── Fix Development: Within 30 days
├── Fix Deployment: Within 45 days
└── Public Disclosure: Within 90 days

What to Report​

Security Vulnerabilities​

Critical Vulnerabilities​

  • Private Key Exposure: Any way to expose private keys
  • Vault Bypass: Any way to bypass vault encryption
  • Unauthorized Access: Any unauthorized access to wallets
  • Data Exfiltration: Any way to extract sensitive data

High Priority Vulnerabilities​

  • Authentication Bypass: Any way to bypass authentication
  • Permission Escalation: Any way to escalate permissions
  • Code Injection: Any code injection vulnerabilities
  • Session Hijacking: Any session hijacking vulnerabilities

Medium Priority Vulnerabilities​

  • Information Disclosure: Any information disclosure
  • Denial of Service: Any denial of service vulnerabilities
  • Cross-Site Scripting: Any XSS vulnerabilities
  • CSRF: Any CSRF vulnerabilities

What NOT to Report​

Out of Scope​

  • Social Engineering: Social engineering attacks
  • Physical Access: Physical access to devices
  • Phishing: Phishing attacks
  • Malware: Malware infections

Low Priority Issues​

  • UI/UX Issues: User interface issues
  • Performance Issues: Performance problems
  • Feature Requests: Feature requests
  • Documentation Issues: Documentation problems

How to Report​

Reporting Channels​

Primary Channel: GitHub Security​

  • Repository: SuperSafe Security
  • Method: GitHub Security Advisories
  • Encryption: End-to-end encrypted
  • Tracking: Full issue tracking

Alternative Channel: Email​

  • Email: security@supersafe.cool
  • Subject: [SECURITY] Brief description
  • Encryption: PGP encryption preferred
  • Response: Within 24 hours

Report Format​

Required Information​

  • Vulnerability Type: Type of vulnerability
  • Severity: Severity level (Critical, High, Medium, Low)
  • Description: Detailed description
  • Steps to Reproduce: Step-by-step reproduction
  • Impact: Potential impact
  • Mitigation: Suggested mitigation

Report Template​

Security Vulnerability Report

Vulnerability Type: [Critical/High/Medium/Low]
Severity: [Critical/High/Medium/Low]
Description: [Detailed description of the vulnerability]

Steps to Reproduce:
1. [Step 1]
2. [Step 2]
3. [Step 3]

Expected Behavior: [What should happen]
Actual Behavior: [What actually happens]

Impact: [Potential impact of the vulnerability]
Mitigation: [Suggested mitigation if any]

Environment:
- Browser: [Browser and version]
- OS: [Operating system and version]
- SuperSafe Version: [SuperSafe version]
- Extension Version: [Extension version]

Additional Information:
[Any additional information]

Security Research Guidelines​

Research Scope​

In Scope​

  • SuperSafe Wallet Extension: Chrome extension
  • SuperSafe Website: Official website
  • SuperSafe APIs: Public APIs
  • SuperSafe Documentation: Public documentation

Out of Scope​

  • Third-party Services: External services
  • User Devices: User devices and systems
  • Network Infrastructure: Network infrastructure
  • Social Engineering: Social engineering attacks

Research Guidelines​

Ethical Guidelines​

  • Responsible Disclosure: Follow responsible disclosure
  • No Data Access: Don't access user data
  • No Disruption: Don't disrupt services
  • Respect Privacy: Respect user privacy

Technical Guidelines​

  • Test Environment: Use test environment
  • Minimal Impact: Minimize impact
  • Document Everything: Document all findings
  • Report Promptly: Report findings promptly

Bug Bounty Program​

Program Overview​

Eligibility​

  • Security Researchers: Independent security researchers
  • Security Companies: Security companies
  • Academic Researchers: Academic researchers
  • Community Members: Community members

Rewards​

  • Critical: $1,000 - $5,000
  • High: $500 - $1,000
  • Medium: $100 - $500
  • Low: $50 - $100

Reward Criteria​

Critical Vulnerabilities​

  • Private Key Exposure: $5,000
  • Vault Bypass: $3,000
  • Unauthorized Access: $2,000
  • Data Exfiltration: $1,000

High Priority Vulnerabilities​

  • Authentication Bypass: $1,000
  • Permission Escalation: $750
  • Code Injection: $500
  • Session Hijacking: $500

Medium Priority Vulnerabilities​

  • Information Disclosure: $250
  • Denial of Service: $200
  • Cross-Site Scripting: $150
  • CSRF: $100

Payment Process​

Payment Timeline​

  • Report Submission: Submit vulnerability report
  • Triage: Within 48 hours
  • Investigation: Within 7 days
  • Fix Development: Within 30 days
  • Fix Deployment: Within 45 days
  • Payment: Within 60 days

Payment Methods​

  • Cryptocurrency: Bitcoin, Ethereum, USDC
  • Bank Transfer: Bank wire transfer
  • PayPal: PayPal payment
  • GitHub Sponsors: GitHub Sponsors

Security Response Process​

Response Timeline​

Initial Response​

  • Acknowledgment: Within 24 hours
  • Triage: Within 48 hours
  • Investigation: Within 7 days
  • Status Update: Within 14 days

Fix Development​

  • Fix Development: Within 30 days
  • Testing: Within 35 days
  • Deployment: Within 45 days
  • Verification: Within 50 days

Public Disclosure​

  • Coordinated Disclosure: Within 90 days
  • Security Advisory: Public security advisory
  • CVE Assignment: CVE assignment if applicable
  • Credit: Researcher credit

Communication​

Regular Updates​

  • Weekly Updates: Weekly status updates
  • Milestone Updates: Milestone updates
  • Final Update: Final resolution update
  • Public Disclosure: Public disclosure

Communication Channels​

  • GitHub Issues: GitHub issue tracking
  • Email: Direct email communication
  • Security Advisory: Public security advisory
  • Blog Post: Blog post announcement

Security Team​

Core Team​

Security Lead​

Security Engineers​

  • Team: Security engineering team
  • Email: security@supersafe.cool
  • GitHub: @supersafe-security
  • Response: 24/7 response

External Advisors​

Security Advisors​

  • Independent Advisors: Independent security advisors
  • Academic Advisors: Academic security advisors
  • Industry Advisors: Industry security advisors
  • Community Advisors: Community security advisors

Security Resources​

Documentation​

Security Documentation​

  • Security Overview: Comprehensive security overview
  • Architecture Security: Security architecture details
  • Threat Model: Threat model documentation
  • Security Controls: Security controls documentation

Technical Resources​

  • API Documentation: Security API documentation
  • Code Documentation: Security code documentation
  • Test Documentation: Security test documentation
  • Deployment Guide: Security deployment guide

Tools and Resources​

Security Tools​

  • Static Analysis: Static code analysis tools
  • Dynamic Analysis: Dynamic analysis tools
  • Penetration Testing: Penetration testing tools
  • Vulnerability Scanning: Vulnerability scanning tools

Research Resources​

  • Test Environment: Test environment access
  • Documentation: Comprehensive documentation
  • Support: Technical support
  • Community: Security community access

Responsible Disclosure​

  • Good Faith: Good faith security research
  • No Legal Action: No legal action for responsible disclosure
  • Cooperation: Cooperation with security team
  • Confidentiality: Confidentiality during investigation
  • Safe Harbor: Safe harbor for security researchers
  • Legal Immunity: Legal immunity for responsible disclosure
  • Protection: Protection from legal action
  • Support: Legal support if needed

Compliance​

Regulatory Compliance​

  • GDPR: General Data Protection Regulation
  • CCPA: California Consumer Privacy Act
  • SOC 2: Service Organization Control 2
  • ISO 27001: Information Security Management

Industry Standards​

  • OWASP: OWASP security standards
  • NIST: NIST security guidelines
  • ISO 27001: ISO 27001 security standards
  • CIS: Center for Internet Security

Community Recognition​

Recognition Program​

Hall of Fame​

  • Security Researchers: Security researchers hall of fame
  • Contributors: Security contributors recognition
  • Community Members: Community members recognition
  • Academic Partners: Academic partners recognition

Recognition Benefits​

  • Public Recognition: Public recognition
  • Community Access: Community access
  • Early Access: Early access to features
  • Special Events: Special events access

Contribution Recognition​

Contribution Types​

  • Vulnerability Reports: Vulnerability reports
  • Security Improvements: Security improvements
  • Documentation: Security documentation
  • Community Support: Community support

Recognition Levels​

  • Gold: Major contributions
  • Silver: Significant contributions
  • Bronze: Regular contributions
  • Community: Community contributions

Contact Information​

Primary Contact​

Security Team​

General Contact​

Emergency Contact​

Critical Issues​

Next Steps​

Now that you understand vulnerability reporting:

  1. Security Overview - Review security overview
  2. Security Configurations - Configure security settings
  3. Advanced Topics - Advanced security topics
  4. For Developers - Developer security

Ready to learn more about security? Continue to Security Overview!