Shift Crypto bug bounty programs
bitbox.swiss Updated
Shift Crypto runs one public program: a Sorona bug bounty.
- Top reward
- Not published
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Shift Crypto runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
BitBox02 (Shift Crypto)
Sorona · Bug bounty |
Not published | Partial | – | 3 days promised | Open |
-
- Safe harbor
- Partial
- First response
- 3 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 5 excluded.
-
https://bitbox.swiss
Web
-
All Shift Crypto hardware, named in the policy in those words: the BitBox02 and Nova devices, the backup card and the Steelwallet product line
Products and areas
-
Any other production code Shift Crypto publishes under github.com/BitBoxSwiss, which the policy names as the scope boundary rather than singling out one repository
Products and areas
-
bitbox02-firmware in full, the Apache-2.0 firmware for BitBox02 and BitBox02 Nova: the bootloader, the secure-chip interaction logic, the USB and HID transport, the encrypted host channel, the screen-confirmation flow and the coin-specific signing code
Products and areas
-
Physical and fault-injection work against the devices themselves, since the hardware is in scope rather than only the code running on it
Products and areas
-
Shift Crypto's own statement of scope: "The main areas are: Official code implementations in production that we maintain and make available at the BitBox GitHub repository. All Shift Crypto hardware." The same passage says information that significantly improves their security is rewarded, and names user and customer privacy as part of that
Products and areas
-
The BitBoxApp desktop and mobile clients, the host side of every operation the device performs: pairing and attestation, backup and restore, address derivation and display, transaction construction and the update path
Products and areas
-
User and customer privacy issues, which the policy calls out explicitly as rewardable rather than treating as a lesser class
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Beta devices and end-of-sale products, which are out by default
-
Denial of service and crash-only bugs, which pay nothing regardless of how reliably they reproduce
-
Issues already public, or already known to Shift Crypto
-
Third-party services the software connects to rather than the software itself
-
Website vulnerabilities of any kind, which are excluded outright and push the whole program onto the firmware and the apps
Recent changes
Reward and scope changes across every Shift Crypto program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under bitbox.swiss: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.