Security Reporting
Last updated:
If you discover a suspected vulnerability or unauthorized access, report it privately to the CryptoVista team. Limit investigation to systems and accounts you are authorized to test.
1. Report privately
Email bilalalam58@gmail.com with a subject beginning Security report. Include the affected URL or feature, time and timezone, prerequisites, a minimal reproduction using your own account, expected and observed behavior and the potential impact. Redact credentials, tokens and unrelated personal information.
2. Protect people and data
Do not access another person’s records, extract data, disrupt availability, modify someone else’s content, send phishing messages or publish a working exploit. If information is exposed unexpectedly, stop at the minimum evidence needed and report it. Do not send live secrets or additional copies of exposed records by email.
3. Coordination and expectations
The team may request further details or arrange an appropriate way to receive necessary sensitive evidence. Do not assume that a public encryption key, paid bounty, guaranteed reward, fixed response period or legal safe-harbor commitment exists unless the team provides it explicitly.
For a suspected compromised exchange key, revoke it at the exchange and disconnect the CryptoVista connection where possible. A vulnerability report is separate from an account-deletion or refund request.