Reporting a Security Problem

We want to hear about security problems in Wallet of Satoshi. If you think you have found one, please tell us.

How to report

Email support@walletofsatoshi.com and start the subject line with "Security report".

Please include:

• what the problem is and where you found it (the app and its version, or the web address);
• the steps to reproduce it;
• what you think someone could do with it; and
• how we can reach you.

You do not need to give us your name.

Please do not report security problems through social media, app store reviews or Telegram. We do not run a Telegram group. Anyone on Telegram who claims to be our staff is not.

What this covers

• The Wallet of Satoshi apps for iOS and Android, and the servers they connect to.
• The walletofsatoshi.com website.

If the problem is in a service another company runs for us, you can report it to that company. If you are not sure, tell us.

Testing in good faith

• Use your own wallets and test data where you can.
• Do only what you need to show the problem, then stop.
• Do not access, download, keep or change other people's information. If you reach it by accident, stop, tell us, and delete any copy you hold.
• Do not move or keep funds that are not yours.
• Do not disrupt the service. This includes denial of service, spam, and automated testing that slows the service for customers.
• Do not phish or mislead our staff or customers.
• Keep the details private until we have fixed the problem and agreed with you on what can be published and when.

What we will do

• Reply to confirm we have your report. We aim to do this within five business days.
• Keep you updated while we work on it, and tell you when it is fixed.
• Not name you publicly without your agreement.

We will not take legal action against you for research that follows this policy. This does not change our obligations to report to regulators or to notify people whose information was affected.

Rewards

We do not run a formal bug bounty program. We may choose to reward a report that helps us fix a serious problem. Whether to give a reward, and how much, is at our discretion. We do not pay rewards that are demanded in exchange for the details of a problem.