Responsible Disclosure Policy

Scope

This policy applies to all security enthusiasts on the internet who may have identified a security problem that could affect xapo software applications including, but not limited too, front end services (web), mobile services, back end and/or mid-tier services.

Policy statement At xapo we take the security of our products very seriously. We educate our staff on security best practices and our development process includes quality assurance steps to ensure our products are of high quality and secure. However, like all complex software products, it is possible that a security vulnerability may be present in one of our products. If you discover a security issue or vulnerability in a xapo product or service, we ask that you report this to us in a confidential manner and in accordance with the guidelines set forth below.

Disclose

Please email the details of any possible or actual security vulnerability or problem to our security team at [email protected]. We appreciate confidential and responsible disclosures and will acknowledge security researchers when an issue has been reported.

When submitting a report, please provide as many relevant details as you can, including, but not limited to, the following:

  1. How the vulnerability can be exploited and the potential impact.
  2. How you discovered the vulnerability and clear steps to reproduce.
  3. Any proof of concept attack and/or images showing the attack vector.
  4. Any known patches or controls to mitigate the vulnerability.

You will not take advantage of the vulnerability or the problem you have discovered or reported nor will you disclose information about it publicly until we have remediated it. You must not require financial compensation inorder to disclose any vulnerabilities as these are not paid unless agreed to in writing.

Please note that while xapo does not currently have a bug bounty program in place, we are happy to credit researchers with their name and a link to an address of their choosing (e.G. Twitter or personal website) on our hall of fame below.

What not to do

  1. Denial-of-service (dos) or distributed dos (ddos) attacks against xapo systems and products;
  2. Testing against systems owned by third-party companies that integrate with xapo products;
  3. Malicious activities against xapo or its customers by leveraging xapo systems;
  4. Testing that would degrade the quality of services offered by xapo; or
  5. The handling of malicious software (including but not limited to uploading, sharing or sending) with respect to xapo.

Xapo will not initiate legal actions against researchers, as long as they adhere to these parameters. Xapo reserves the right to only credit researchers who have reported an issue that is proven and of sufficient severity.

Legalities

This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with applicable law, of which might cause xapo to be in breach of any of its legal obligations.

Security hall of fame

Thank you!

A special thanks to the following people that have responsibly disclosed vulnerabilities to xapo in the past:

  1. Divya singh | @dgirlwhohacks
  2. Phoenix | @phoenixmantis
  3. Foysal ahmed | @foysal1197
  4. Aman sharma | @amannoobda