Bug Bounty Program

Last updated: 20 December 2024

Program Overview

At NGRAVE, the security and privacy of our users are of utmost importance. We actively encourage security researchers and experts to help us enhance our products by identifying potential vulnerabilities. If you discover a security issue that could impact the integrity or confidentiality of NGRAVE’s devices, services, or infrastructure, we invite you to report it to us responsibly. Our security team is committed to working with you to investigate the issue, address it swiftly, and reward you for your efforts.

Scope

Hardware Wallet

Any attacks, whether hardware-based or against our firmware, that could compromise the security of user assets. This covers vulnerabilities that could lead to unauthorized access, manipulation, or extraction of sensitive data such as private keys, transaction information, or any other functionality that may put users’ assets at risk.

Web Services

Any vulnerability that could directly impact NGRAVE’s confidential data, users’ privacy, or the availability of its systems. This includes issues such as unauthorized access, manipulation of transactions, or exposure of sensitive user data.

Out-of-scope

  • Social engineering attacks (e.g., phishing, impersonation)
  • Denial of Service (DoS/DDoS) attacks
  • Vulnerabilities reported by automated scanning tools without proof of impact
  • Low-severity issues (e.g., cookie flags, security headers) without immediate risk
  • Outdated software versions without exploitable vulnerabilities
  • Vulnerabilities in third-party services not owned by NGRAVE
  • Theoretical vulnerabilities without sufficient proof of concept
  • Broken links

Reward Guidelines

We ensure that security researchers who follow our guidelines are protected from legal action and are acknowledged for their contributions.

To participate in our bug bounty program, we ask researchers to follow these guidelines:

  • Act in good faith and take all necessary steps to protect user and company data from exposure or damage.
  • Allow us a reasonable timeframe to resolve any issues before disclosing them publicly.
  • Do not engage in any fraudulent activity against our users or NGRAVE during the discovery process.

You may be eligible to receive a reward if:

  • You are the first person to report a specific vulnerability;
  • You provide a working exploit demonstration. The vulnerability can not be purely theoretical in nature.
  • The vulnerability is validated as a genuine security issue by the NGRAVE Security Team;
  • You have adhered to the NGRAVE Bug Bounty program policy and guidelines.

The decision to award a bounty for a verified security issue is at NGRAVE’s sole discretion. We also reserve the right to make changes to our code in response to a report, even if it was deemed not to be valid. The reward amount is determined based on the classification and sensitivity of the impacted data, the thoroughness of your report, ease of exploitation, and the overall risk posed to NGRAVE’s users and brand.

How to report

To report a security vulnerability, please contact our Security Team directly with the following information:

  • Code: A proof of concept demonstrating the issue.
  • Detailed description: A thorough explanation of the bug and its potential impact.

Send it to the following email address: security@ngrave.io

Please encrypt any sensitive information with the following PGP key: NGRAVE PGP Key