Security at Cryptorefills

We take the security of our platform and our customers' data seriously. If you believe you have found a security vulnerability in Cryptorefills, we want to hear from you. This page explains how to report it and what you can expect from us.

Reporting a vulnerability

Email your report to support@cryptorefills.com. Please include:

  • The affected URL, endpoint or feature.
  • Steps to reproduce the issue, with any relevant payloads.
  • The impact you believe the issue has.
  • A way to reach you for follow-up questions, if different from the sending address.

We aim to acknowledge every report within 5 business days. We will keep you informed while we investigate and let you know when the issue is resolved.

Our commitment to researchers

We will not pursue legal action against researchers who act in good faith and within this policy. Acting in good faith means:

  • You only access, modify or delete data that belongs to you or to test accounts you created.
  • You do not degrade or disrupt the service for other users.
  • You give us a reasonable amount of time to fix the issue before disclosing it publicly.
  • You do not use a vulnerability beyond what is needed to demonstrate it.

Out of scope

The following are not in scope for reports:

  • Denial-of-service or other volumetric attacks.
  • Social engineering or phishing of our staff, suppliers or customers.
  • Physical attacks against our offices or infrastructure.
  • Reports from automated scanners without a demonstrated, exploitable impact.
  • Missing security headers or email authentication records (SPF, DKIM, DMARC) without a working proof of concept.
  • Vulnerabilities in third-party services we use but do not operate. Please report those to the service in question.

Rewards

We do not currently run a paid bug bounty program. We are happy to credit you for a valid report if you would like us to.

How we handle payment data

Payments on Cryptorefills are made from your own wallet to a one-time payment address generated for your order. We never ask for your private keys or seed phrase, and no page or email from us ever will.

Machine-readable policy

This policy is referenced from www.cryptorefills.com/.well-known/security.txt, following RFC 9116.