Bug Bounty Program

1. Scope

In scope: the Danny Wallet mobile and desktop/web wallet apps, the wallet web app at app.dannywallet.com, this website, and the open-source code at github.com/Dannywallet/danny-wallet.

Out of scope: third-party dApps, exchanges, and bridges; the underlying blockchains; social engineering and physical attacks; spam, automated scanner output without a working proof of concept, and issues that require a rooted/jailbroken or already-compromised device.

2. What We're Looking For

High-impact issues such as: theft or unauthorized movement of funds, recovery-phrase or private-key exposure, PIN/encryption bypass, transaction tampering, remote code execution, and authentication or signing flaws.

Also welcome: phishing-protection bypasses, address-spoofing, and serious data-leak or privacy issues.

3. Reward Tiers

Critical (key/fund compromise, RCE): up to $10,000.

High (signing bypass, serious data exposure): $1,000–$5,000.

Medium (meaningful security weakness): $250–$1,000.

Low / informational: swag and public acknowledgment.

Rewards are at our discretion and depend on severity, impact, and report quality.

4. Rules of Engagement

Only test against your own accounts and devices. Never access, modify, or exfiltrate other users’ data or funds.

Give us a reasonable time to fix an issue before any public disclosure. Do not exploit a vulnerability beyond what is needed to demonstrate it.

Do not run denial-of-service attacks, spam, or automated testing that degrades the Service for others.

5. How to Report

Email a detailed report to security@dannywallet.com, or open a private security advisory on our GitHub repository at github.com/Dannywallet/danny-wallet.

Include clear steps to reproduce, the impact, affected versions/components, and a proof of concept. The more reproducible your report, the faster we can validate and reward it.

6. Safe Harbor

We will not pursue legal action against researchers who act in good faith, follow these rules, and disclose responsibly. If in doubt about whether an action is allowed, ask us first.