CoinDCX Vulnerability Disclosure

Disclosure Policy

• Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.

• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
• Only interact with accounts you own or with the explicit permission of the account holder.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Denial of service (DoS) attacks on CoinDCX Group applications, servers, networks, or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate a large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any of our applications or servers.
• Do not copy any files from our applications or servers and disclose them.
• Please avoid spamming support requests.
• Do not alter compromised accounts by creating, deleting, removing, or modifying any data.
• Do not use compromised accounts to search for post-authentication vulnerabilities.
• Do not include Personally Identifiable Information (PII) in your report, and redact or obfuscate any PII in your PoC as much as possible.
• For exposed credentials or secrets, limit yourself to verifying the credentials' validity.
• For sensitive information leaks, do not extract or copy exposed data; limit yourself to describing and listing what is exposed.

Session Layer: HTTP Headers

Researchers should add headers to requests, such as:

• "X-HackerOne-Research: [H1 username]"

Gold Standard Safe Harbor

Gold Standard Safe Harbor supports the protection of organizations and hackers engaged in Good Faith Security Research. "Good Faith Security Research" is accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services, and is conducted strictly in accordance with the applicable HackerOne program terms, the applicable program scope, testing restrictions and the organization's bug bounty policy.

We consider Good Faith Security Research conducted strictly in accordance with the applicable Program terms, scope and testing restrictions to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Service ("TOS") and/or Acceptable Use Policies ("AUP") that directly conflicts with the standard for Good Faith Security Research outlined here, solely to the extent necessary to permit the research.

This means that, for activity conducted while this program is active, and strictly in accordance with the applicable Program terms, scope and testing restrictions, we:

• Will not voluntarily initiate legal action against you or report you to law enforcement solely on account of Good Faith Security Research, including reasonable and necessary circumvention of technological measures we use solely to the extent required to demonstrate an in-scope vulnerability; provided that this commitment does not apply where disclosure or reporting is required by applicable law or is reasonably necessary to protect the applications in scope, our rights, users, systems or assets; and
• Will take steps (where reasonable and practicable) and subject to applicable law, and confidentiality obligations to make known that you conducted Good Faith Security Research if someone else brings legal action against you.

You should contact us for clarification before engaging in conduct that you think may be inconsistent with Good Faith Security Research or unaddressed by our policy. Where proposed testing may reasonably result in access to sensitive data, disruption of services, interaction with third-party systems, financial transactions or movement of assets, you must obtain prior written authorization through the Program before proceeding.

Keep in mind that we are not able to authorize security research on third-party infrastructure, and a third party is not bound by this safe harbor statement. Nothing in this Safe Harbor authorizes access to or testing of infrastructure, systems, applications, APIs, accounts or services owned or controlled by a third party, even where such infrastructure or services are integrated with or accessible through a CoinDCX service.

Good Faith AI Research Safe Harbor

We consider Good Faith AI Research, conducted strictly in accordance with the applicable Program terms, scope and testing restrictions, to be authorized activity that is protected from adversarial legal action by us.

With respect to Good Faith AI research conducted on an AI system owned or controlled by us and reported to us while this program is active, we will:

• Exempt such Good Faith AI Research from any relevant restriction in our Terms of Service ("TOS") and/or Acceptable Use Policies ("AUP") that would potentially interfere with AI research under this policy on a limited basis;
• Not voluntarily initiate legal action against you or report you for Good Faith AI Research, including reasonable and necessary circumvention of technological measures we use solely to the extent required to protect the AI system in scope, provided that this commitment does not apply where disclosure or reporting is required by applicable law or is reasonably necessary to protect the applications in scope, our rights, users, systems or assets; and;
• Take steps (where reasonable and practicable) and subject to applicable law, and confidentiality obligations to make known that you conducted Good Faith AI Research if someone else brings legal action against you, to the extent we have such information available and if requested by you.

For the purposes of this policy, "Good Faith AI Research" means: accessing or using an AI system for the purposes of good-faith testing, evaluation, investigation, and/or correction of a potential flaw, vulnerability, or unintended outcome, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the AI system, or those who use such AI system. Examples of conduct that may be inconsistent with this definition include withholding findings unless payment is provided, unnecessary damage to systems or exfiltration of sensitive data, or reverse engineering, training, and/or otherwise duplicating an AI system to create a competing product or service.

This policy applies only to Good Faith AI Research conducted on our systems. We are not able to authorize AI research on third-party AI systems, and third parties are not bound by this safe harbor statement. Nothing in this Safe Harbor authorizes access to or testing of infrastructure, systems, applications, APIs, AI, accounts or services owned or controlled by a third party, even where such infrastructure or services are integrated with or accessible through a CoinDCX service.

You should contact us for clarification before engaging in conduct that you think may be inconsistent with the definition of Good Faith AI Research or unaddressed by our policy. Where proposed testing may reasonably result in access to sensitive data, disruption of services, interaction with third-party systems, financial transactions or movement of assets, you must obtain prior written authorization through the Program before proceeding.

Thank you for helping keep CoinDCX Group and our users safe!