- Top reward
- $15,000
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $15,000
- for critical bugs, from $200.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Paid by Bitcoin, Ether
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$15,000 from $4,000 |
| High |
|
$4,000 from $1,000 |
| Medium |
|
$1,000 from $200 |
| Low |
|
$200 |
- Top reward
-
$15,000
Critical │ $4,000 - $15,000
- Lowest reward
-
$200
Low │ up to $200
- Safe harbor
-
Full
To encourage responsible disclosure, we are not going to start legal action against the researchers who point out a problem provided they do their best to follow the guidelines above.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 6 excluded.
Android apps 2
- All services provided by SpectroCoin are eligible for our bug bounty program, including the iOS and Android SpectroCoin apps, SpectroCoin Wallet, API, Merchant Tools, Cards and Exchange. In general, vulnerabilities that have the potential for financial loss or data breach are considered of sufficient severity.
- Android SpectroCoin apps
APIs 1
- API
Products and areas 5
- All services provided by SpectroCoin
- Cards
- Exchange
- Merchant Tools
- SpectroCoin Wallet
Out of scope (6)
- Clickjacking on pages with no sensitive actions
- CSRF on forms that require no authentication or on non sensitive actions
- Flash based exploits
- Host header injection without a specific and demonstrable impact
- Lack of DNSSEC
- Vulnerabilities that require Man-in-the-middle attack (MITM), or physical access to a user’s web browser, email account, smartphone and issues on rooted/jailbroken devices
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SpectroCoin's policy. "We" in these lines means the program, not this site.
While testing
-
Do not publicly share any files and/or details related to the vulnerability.
-
Include your BTC/ETH address for payment.
-
For exploits that need account access you must use your own account.
-
If you inadvertently access private data, we ask that you delete all related information, including but not limited to access codes, private data, etc., after notifying us.
-
If in the case of a bug you were able to access and/or move funds from SpectroCoin, you commit to returning the whole amount to SpectroCoin.
-
Providing us a reasonable amount of time to fix the issue before publishing it elsewhere.
-
Non-violation of the privacy of other users, destroying any data or disrupting our services, etc. (acting in good faith).
-
Not defrauding SpectroCoin users (do not interact with an individual account which includes modifying or accessing data from the account) or SpectroCoin itself in the process of discovery.
Not accepted
-
Lack of DNSSEC
-
Host header injection without a specific and demonstrable impact
-
Flash based exploits
-
CSRF on forms that require no authentication or on non sensitive actions
-
Clickjacking on pages with no sensitive actions
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.