| 1 | # Security Policy |
| 2 | |
| 3 | Cake Wallet is developed by **Cake Labs LLC**. We take the security and privacy of |
| 4 | our users seriously and welcome reports from security researchers. |
| 5 | |
| 6 | > **Cake Wallet is not affiliated with CAKE.com, Clockify, or security.cake.com.** |
| 7 | > Those services belong to unrelated companies. The only official vulnerability |
| 8 | > disclosure channels for Cake Wallet are the ones listed on this page and at |
| 9 | > https://cakewallet.com/security. |
| 10 | |
| 11 | ## Reporting a vulnerability |
| 12 | |
| 13 | **Please do not open a public issue, pull request, or social-media post for a |
| 14 | security vulnerability.** Public disclosure before a fix is available puts users' |
| 15 | funds and privacy at risk. Use one of the private channels below and we will |
| 16 | coordinate a fix and disclosure with you. |
| 17 | |
| 18 | 1. **GitHub private security advisory (preferred).** |
| 19 | [Report a vulnerability](https://github.com/cake-tech/cake_wallet/security/advisories/new). |
| 20 | This gives you a private, structured thread with the maintainers and is the |
| 21 | fastest way to reach us. |
| 22 | 2. **Encrypted email.** Send details to **security@cakewallet.com**. For sensitive |
| 23 | reports, please encrypt with our PGP key: |
| 24 | - Key: https://cakewallet.com/.well-known/cakewallet-security.asc |
| 25 | - Fingerprint: `DC91 6520 0271 AC6A 0533 3D3C BFE7 D9A5 0E4D 3A0A` |
| 26 | |
| 27 | Both channels are monitored and automatically raise an alert in our internal |
| 28 | security channel, so reports will not be missed. |
| 29 | |
| 30 | ### What to include |
| 31 | |
| 32 | - A clear description of the issue and its security impact. |
| 33 | - A working proof of concept is required. It must run directly against Cake |
| 34 | Wallet itself, using a release build or locally built version, and demonstrate |
| 35 | the reported behavior and security impact. Standalone Python code, |
| 36 | mathematical examples, or simulations that only reproduce the theory without |
| 37 | exercising Cake Wallet do not satisfy this requirement. |
| 38 | - Step-by-step reproduction instructions. |
| 39 | - Affected platforms (iOS, Android, macOS, Linux, Windows) and app version. |
| 40 | - Affected wallet types / chains, if applicable. |
| 41 | - Any relevant logs, addresses, or transaction IDs (for on-chain issues). |
| 42 | |
| 43 | If you used AI tooling to find or write up the report, please say so. |
| 44 | |
| 45 | ### Communication expectations |
| 46 | |
| 47 | AI should not be used to generate comments when communicating with maintainers |
| 48 | and other contributors. Comments are expected to be written by humans. Comments |
| 49 | that are believed to be written by AI may be moderated. |
| 50 | |
| 51 | ## Our commitment (safe harbor) |
| 52 | |
| 53 | We consider security research conducted in good faith under this policy to be |
| 54 | authorized. We will not pursue or support legal action against researchers who: |
| 55 | |
| 56 | - make a good-faith effort to avoid privacy violations, data destruction, and |
| 57 | interruption or degradation of our services; |
| 58 | - only interact with accounts they own or have explicit permission to access; and |
| 59 | - give us a reasonable opportunity to fix an issue before disclosing it publicly. |
| 60 | |
| 61 | If in doubt about whether an action is authorized, ask us first at |
| 62 | security@cakewallet.com. |
| 63 | |
| 64 | ## What to expect |
| 65 | |
| 66 | - **Acknowledgement:** within **2 business days**. |
| 67 | - **Triage and initial assessment:** within **7 business days**. |
| 68 | - **Coordinated disclosure:** we aim to ship a fix and coordinate public |
| 69 | disclosure within **90 days** of the report. We will keep you updated on |
| 70 | progress and agree on a disclosure date with you. |
| 71 | - **Credit:** with your permission, we are happy to publicly credit you for the |
| 72 | report once a fix is released. |
| 73 | |
| 74 | ## Scope |
| 75 | |
| 76 | **In scope:** the Cake Wallet and Monero.com applications and the code in this |
| 77 | repository and its sibling `cake-tech` repositories — anything that could lead to |
| 78 | loss of funds, exposure of keys or seeds, a privacy leak, or a |
| 79 | failed/incorrect transaction. |
| 80 | |
| 81 | **Out of scope:** issues in third-party services, exchange/swap providers, or |
| 82 | nodes we do not operate; reports generated solely by automated scanners without a |
| 83 | demonstrated impact; low-severity or informational issues on our marketing and |
| 84 | landing websites (for example reflected or self-XSS, missing security headers, |
| 85 | clickjacking on pages with no sensitive actions, or SPF/DMARC and cookie-flag |
| 86 | nitpicks) that do not affect the app or user funds; and social-engineering or |
| 87 | physical attacks. |
| 88 | |
| 89 | ## Rewards |
| 90 | |
| 91 | At our **sole discretion**, we may offer a reward for a valid report. To be |
| 92 | eligible, a report must: |
| 93 | |
| 94 | - be submitted **privately** through one of the channels above (a GitHub private |
| 95 | security advisory or `security@cakewallet.com`) — anything disclosed publicly or |
| 96 | sent through other channels is not eligible; and |
| 97 | - identify a genuine vulnerability with real impact on users — typically loss of |
| 98 | funds, exposure of keys or seeds, a privacy leak, or a failed or incorrect |
| 99 | transaction. |
| 100 | |
| 101 | Trivial or low-impact findings are **not** eligible — for example, reflected XSS |
| 102 | or other low-severity issues on our marketing websites, missing security headers, |
| 103 | hardening or best-practice suggestions, automated-scanner output without a working |
| 104 | proof of concept, or already-known issues. There is no fixed bounty and no |
| 105 | guaranteed payout; whether a report qualifies, and any amount, are determined |
| 106 | solely by Cake Labs LLC. |
| 107 | |
| 108 | ## Supported versions |
| 109 | |
| 110 | We do not maintain previous releases. Only the **latest release for each platform** |
| 111 | is supported; security fixes are delivered in new versions. Please keep Cake Wallet |
| 112 | up to date. |