[{"id":3781701,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n==DO NOT test Exodus Exchange and XOSWAP features, endpoints and hosts or anything related to it, Do not conduct any testing that leads to creating an order, exchange or swap, Your report will be closed as Not Applicable==\n\n#Known Findings but not limited to:\n\n| Asset | Out of scope finding class |\n|---|---|\n| `fiat.a.exodus.io` | Unauthenticated HMAC signing oracle on `/api/v1/sign` and `/api/sign-url`, including forged MoonPay, Ramp, Onramper and Blockchain.com partner signatures |\n| `exchange.exodus.io`, `api.xoswap.com` | Unauthenticated read, enumeration or write on swap order endpoints under `/v3` and `/v4`, including `App-Name` header spoofing and order ID enumeration |\n| `api.passkeys.network` | Unauthenticated access to the relay and pairing message bus at `/api/v1/messages`, including message read, write, delete, interception and credential ID or wallet UUID lookup |\n| `*.a.exodus.io` | Unauthenticated access to Substrate API sidecar and public blockchain RPC node endpoints, including chain data, node version, internal IP and stack trace disclosure |\n| `@exodus/errors` | Incomplete redaction in `sanitizeErrorMessage()`, including 15, 18 and 21 word mnemonics, non English wordlists, base58 values and non whitespace separators |\n| `@exodus/keychain` | Race between `lock()` and a pending `unlock()` or import that restores key material, signing or private key export after lock returns |\n| `my.passkeys.network` | `postMessage` origin validation weaknesses and referrer trusted origins, including session ID overwrite, session fixation and cross origin identity disclosure |\n| `fetch-n-cache.a.exodus.io` | Open fetch proxy and outbound SSRF reachable with the publicly distributed client API key |\n| `*.a.exodus.io` | OAuth2 `redirect_uri` validation bypass and authorization code interception |\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 5 days |\n| Time to Triage | \u003c 15 days |\n| Time to Bounty | \u003c 40 days|\n| Time to Resolution | depends on severity and complexity |\n\nWe are dealing with large influx of AI based reports, both valid and invalid and we are running internal tooling as well which will take time to de-dupe external findings against internal findings and we will only reward once the report is marked fixed . We’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. \n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n# Note: We are aware of a few Browser Address Bar Spoofing vulnerabilities and are planning to patch them under upcoming releases with no definitive timeline, For the time being we will be not paying out for these. \n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2026-09-04T12:10:34.633Z"},{"id":3781698,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n==DO NOT test Exodus Exchange and XOSWAP features, endpoints and hosts or anything related to it, Do not conduct any testing that leads to creating an order, exchange or swap, Your report will be closed as Not Applicable==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 5 days |\n| Time to Triage | \u003c 15 days |\n| Time to Bounty | \u003c 40 days|\n| Time to Resolution | depends on severity and complexity |\n\nWe are dealing with large influx of AI based reports, both valid and invalid and we are running internal tooling as well which will take time to de-dupe external findings against internal findings and we will only reward once the report is marked fixed . We’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. \n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n# Note: We are aware of a few Browser Address Bar Spoofing vulnerabilities and are planning to patch them under upcoming releases with no definitive timeline, For the time being we will be not paying out for these. \n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2026-09-04T11:34:50.040Z"},{"id":3779851,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n==DO NOT test Exodus Exchange and XOSWAP features, endpoints and hosts or anything related to it, Do not conduct any testing that leads to creating an order, exchange or swap, Your report will be closed as Not Applicable==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. \n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n# Note: We are aware of a few Browser Address Bar Spoofing vulnerabilities and are planning to patch them under upcoming releases with no definitive timeline, For the time being we will be not paying out for these. \n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2026-08-05T20:57:21.409Z"},{"id":3765840,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. \n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n# Note: We are aware of a few Browser Address Bar Spoofing vulnerabilities and are planning to patch them under upcoming releases with no definitive timeline, For the time being we will be not paying out for these. \n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2025-11-10T18:35:06.537Z"},{"id":3760007,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. \n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2025-07-25T12:05:33.702Z"},{"id":3749702,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness), 12W secret seed phrases found in source code within Exodus attack surface. \n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2025-02-06T17:29:23.849Z"},{"id":3678178,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness)\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `bugbounty@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2022-10-05T06:07:26.434Z"},{"id":3671293,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Exodus.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Add **`h1-\u003cYour-HackerOne-Username\u003e`** in the **`User-Agent`** header to help us filter out traffic and whitelist your IP, otherwise your IP could be added to an explicit block rule.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub / openapi issue. (also mentioned in specific scopes for increased awareness)\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2022-05-13T05:37:41.190Z"},{"id":3654386,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-07-08T11:20:15.083Z"},{"id":3654385,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100.\n* Maximum reward for a vulnerability report: $100,000 \n \n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-07-08T10:59:42.681Z"},{"id":3654381,"new_policy":"Exodus is one of the top non-custodial crypto wallets. We value our customers wallet's security more than anything. We are looking forward to working with you.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 3 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nReward decisions are up to the discretion of Exodus.\n* Minimum reward for a vulnerability report: $100.\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Weaknesses that would require Email Phishing or Social Engineering\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 3 stable versions behind the latest released stable version]\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-07-08T09:06:42.239Z"},{"id":3649071,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly hack1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-02-25T09:05:08.762Z"},{"id":3648830,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before beginning the testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly h1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-02-17T11:50:23.576Z"},{"id":3648829,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n==Do NOT test Exodus contact form and do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before proceeding with testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly h1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-02-17T11:49:59.245Z"},{"id":3648828,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n==Do NOT test Exodus contact form, do NOT create multiple support tickets via Exodus support features. Please read out-of-scope section before proceeding with testing==\n\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly h1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-02-17T11:47:35.858Z"},{"id":3648827,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n* Please avoid creating tickets to test in-wallet customer support mailbox.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly h1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email `h1@exodus.com` and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2021-02-17T11:44:18.180Z"},{"id":3644749,"new_policy":"Exodus looks forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.  Our number one goal is to ensure that our users never have their wallet funds at risk.  Because our wallet is largely software-based, we're hoping the security community can help.\n\n# Response Targets\nExodus will make a best effort to meet the following SLAs for hackers participating in our program:\n\n| Type of Response | SLA in business days |\n| ------------- | ------------- |\n| First Response | \u003c 1 day |\n| Time to Triage | \u003c 1 day |\n| Time to Bounty | \u003c 7 days (We respect your time and don't hesitate to reward) |\n| Time to Resolution | depends on severity and complexity, typically pretty fast though |\n\nWe’ll try to keep you informed about our progress throughout the process.\n\n# Disclosure Policy\n* Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\n\n# Program Rules\n* Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\n* Please add string(h1-\u003cYour-HackerOne-Username\u003e) in your `User-Agent` header to help us filter out traffic and whitelist your IP.\n* Please avoid creating tickets to test in-wallet customer support mailbox.\n\n\n### Report submission\n* When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug/vulnerability. The [Google Bug Hunters University guide](https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario) may be useful in considering whether an issue has security impact.\n* Submit one vulnerability per report.  **WARNING:** If the same exploit occurs across multiple endpoints, please include those endpoints under your single submission.  Do **NOT** file multiple reports for the same exploit.\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (see above item).\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service (including denial of service). Only interact with accounts you own or with explicit permission of the account holder.  If you do accidentally cause some noticeable interruption of service, please immediately email us so we can handle it accordingly h1@exodusmovement.opsgenie.net and please include the subject title \"HackerOne Outage: \u003cdescription\u003e\" for the alert to trigger.\n\n# Rewards\nOur rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Exodus.\n\n* Minimum reward for a vulnerability report: $100.\n\nAll payments are made through [HackerOne](https://hackerone.com/faq#bounties-how-do-i-get-paid)\n\n# In scope vulnerabilities\n* Technical vulnerabilities or security-related problems in any of our company's internet public surface (websites and subdomains underneath Exodus's control)\n* Technical vulnerabilities or security-related problems in our company's Desktop Wallet application. \n\n### External Dependencies\nExodus makes use of a number of open (and closed) source libraries. If you discover a vulnerability in\nan open source dependent library or OS component, we advise you to follow responsible disclosure procedures directly with the library or OS vendor.  We will not pay bounties on undisclosed vulnerabilities in dependent components.  However, if one of those libraries included you can demonstrate a serious vulnerability of any of our software/servers as a result of that library with a working Proof of Concept, we will on a case-by-case basis consider this in-scope and grant rewards.\n\n# Out of scope vulnerabilities\nIf you find a vulnerability that is not part of the **In scope vulnerabilities**, please report it and we will investigate it and depending on the severity of the vulnerability, you will be listed in our Hall of Fame and may be eligible for a reward. Any rewards for out of scope vulnerabilities will be granted on a case by case basis.\n\n### The following issues are currently considered *out of scope*:\n\n* Clickjacking on pages with no sensitive actions\n* Weaknesses that would require Email Phishing or Social Engineering\n* Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions\n* Attacks requiring MITM or physical access to a user's device.\n* Previously known vulnerable libraries without a working Proof of Concept.\n* Comma Separated Values (CSV) injection without demonstrating a vulnerability.\n* Missing best practices in SSL/TLS configuration.\n* Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS\n* Sites/Software that is run entirely by another company that is simply subdomain-ed or linked to from our company.  Eg: Constant Contact, Zendesk, etc.\n* Missing best practices in Content Security Policy.\n* Missing HttpOnly or Secure flags on cookies\n* Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)\n* Vulnerabilities only affecting users of outdated or unpatched browsers or wallets [Less than 2 stable versions behind the latest released stable version]\n* Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).\n* Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.\n* Package include/dependency vulnerabilities without demonstrating a vulnerability.\n* Tabnabbing\n* Open redirect - unless an additional security impact can be demonstrated\n* Issues that require unlikely user interaction\n* (KNOWN ISSUE) Disclosure of methods/endpoints/api keys involving 3rd party blockchain APIs (ex. bitcoin, tezos, waves etc) including known embedded API key, and known outdated swaggerhub/openapi issue. (also mentioned in specific scopes for increased awareness)\n* DLL Hijacking vulnerabilities.\n\n### The following issues are currently considered *do not attempt without permission*:\n\n* Extended testing/attacks of Exodus servers or infrastructure\n* Rate limiting or brute-force attacks on exodus backend infrastructure\n* Any activity that could lead to the disruption of our service (DoS).\n\nTo request permission, please email h1@exodus.io and mention the details of your test including what endpoint(s) you will be hitting, what type of scan/attack/etc you would like to try, and what you're trying to achieve.  We will respond within 2 working days, ideally less to your request.  As long as it is reasonably well thought out and we don't see a risk on our end, we will approve the request.\n\n# Safe Harbor\nAny activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not report to any law enforcement agencies or initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, Exodus will take steps to make it known that your actions were conducted in compliance with this policy.\n\nThank you for helping keep Exodus and our users safe!\n","has_open_scope":null,"pays_within_one_month":null,"protected_by_gold_standard_safe_harbor":null,"protected_by_ai_safe_harbor":null,"disclosure_declaration":null,"introduction":null,"platform_standards_exclusions":[],"exemplary_standards_exclusions":[],"scope_exclusions":[],"timestamp":"2020-11-04T17:57:44.343Z"}]