security: harden vulnerability disclosure policy (#3419)
* security: harden vulnerability disclosure policy + Slack routing * security: add discretionary reward policy and marketing-site out-of-scope
Seth For Privacy committed
Jul 20, 2026 at 17:08 UTC
41e2cba322cb97581bdd8c83af2b6d2601b66da1
1 file changed
+95
-6
docs/SECURITY.md
+95
-6
@@ -1,12 +1,101 @@
1
# Security Policy
2
3
-## Reporting a Vulnerability
3
+Cake Wallet is developed by **Cake Labs LLC**. We take the security and privacy of
4
+our users seriously and welcome reports from security researchers.
5
5
-If you need to report a vulnerability, please either:
6
+> **Cake Wallet is not affiliated with CAKE.com, Clockify, or security.cake.com.**
7
+> Those services belong to unrelated companies. The only official vulnerability
8
+> disclosure channels for Cake Wallet are the ones listed on this page and at
9
+> https://cakewallet.com/security.
10
7
-* Open a security advisory: https://github.com/cake-tech/cake_wallet/security/advisories/new
8
-* Send an email to `dev@cakewallet.com` with details on the vulnerability
11
+## Reporting a vulnerability
12
10
-## Supported Versions
13
+**Please do not open a public issue, pull request, or social-media post for a
14
+security vulnerability.** Public disclosure before a fix is available puts users'
15
+funds and privacy at risk. Use one of the private channels below and we will
16
+coordinate a fix and disclosure with you.
17
12
-As we don't maintain previous versions of the app, only the latest release for each platform is supported and any updates will bump the version number.
18
+1. **GitHub private security advisory (preferred).**
19
+ [Report a vulnerability](https://github.com/cake-tech/cake_wallet/security/advisories/new).
20
+ This gives you a private, structured thread with the maintainers and is the
21
+ fastest way to reach us.
22
+2. **Encrypted email.** Send details to **security@cakewallet.com**. For sensitive
23
+ reports, please encrypt with our PGP key:
24
+ - Key: https://cakewallet.com/.well-known/cakewallet-security.asc
25
+ - Fingerprint: `DC91 6520 0271 AC6A 0533 3D3C BFE7 D9A5 0E4D 3A0A`
26
+
27
+Both channels are monitored and automatically raise an alert in our internal
28
+security channel, so reports will not be missed.
29
+
30
+### What to include
31
+
32
+- A clear description of the issue and its security impact.
33
+- Step-by-step reproduction, ideally with a proof of concept.
34
+- Affected platforms (iOS, Android, macOS, Linux, Windows) and app version.
35
+- Affected wallet types / chains, if applicable.
36
+- Any relevant logs, addresses, or transaction IDs (for on-chain issues).
37
+
38
+If you used AI tooling to find or write up the report, please say so.
39
+
40
+## Our commitment (safe harbor)
41
+
42
+We consider security research conducted in good faith under this policy to be
43
+authorized. We will not pursue or support legal action against researchers who:
44
+
45
+- make a good-faith effort to avoid privacy violations, data destruction, and
46
+ interruption or degradation of our services;
47
+- only interact with accounts they own or have explicit permission to access; and
48
+- give us a reasonable opportunity to fix an issue before disclosing it publicly.
49
+
50
+If in doubt about whether an action is authorized, ask us first at
51
+security@cakewallet.com.
52
+
53
+## What to expect
54
+
55
+- **Acknowledgement:** within **2 business days**.
56
+- **Triage and initial assessment:** within **7 business days**.
57
+- **Coordinated disclosure:** we aim to ship a fix and coordinate public
58
+ disclosure within **90 days** of the report. We will keep you updated on
59
+ progress and agree on a disclosure date with you.
60
+- **Credit:** with your permission, we are happy to publicly credit you for the
61
+ report once a fix is released.
62
+
63
+## Scope
64
+
65
+**In scope:** the Cake Wallet and Monero.com applications and the code in this
66
+repository and its sibling `cake-tech` repositories — anything that could lead to
67
+loss of funds, exposure of keys or seeds, a privacy leak, or a
68
+failed/incorrect transaction.
69
+
70
+**Out of scope:** issues in third-party services, exchange/swap providers, or
71
+nodes we do not operate; reports generated solely by automated scanners without a
72
+demonstrated impact; low-severity or informational issues on our marketing and
73
+landing websites (for example reflected or self-XSS, missing security headers,
74
+clickjacking on pages with no sensitive actions, or SPF/DMARC and cookie-flag
75
+nitpicks) that do not affect the app or user funds; and social-engineering or
76
+physical attacks.
77
+
78
+## Rewards
79
+
80
+At our **sole discretion**, we may offer a reward for a valid report. To be
81
+eligible, a report must:
82
+
83
+- be submitted **privately** through one of the channels above (a GitHub private
84
+ security advisory or `security@cakewallet.com`) — anything disclosed publicly or
85
+ sent through other channels is not eligible; and
86
+- identify a genuine vulnerability with real impact on users — typically loss of
87
+ funds, exposure of keys or seeds, a privacy leak, or a failed or incorrect
88
+ transaction.
89
+
90
+Trivial or low-impact findings are **not** eligible — for example, reflected XSS
91
+or other low-severity issues on our marketing websites, missing security headers,
92
+hardening or best-practice suggestions, automated-scanner output without a working
93
+proof of concept, or already-known issues. There is no fixed bounty and no
94
+guaranteed payout; whether a report qualifies, and any amount, are determined
95
+solely by Cake Labs LLC.
96
+
97
+## Supported versions
98
+
99
+We do not maintain previous releases. Only the **latest release for each platform**
100
+is supported; security fixes are delivered in new versions. Please keep Cake Wallet
101
+up to date.