Bug Bounty
Report a Vulnerability
Help us keep Rapidtrade secure. We reward security researchers who responsibly disclose vulnerabilities.
Bounty Rewards
CriticalCVSS 9.0 - 10.0
$50,000 - $250,000Remote code execution on production systemsPrivate key or seed phrase exfiltrationUnauthorized fund transfersSmart contract vulnerabilities affecting user fundsAuthentication bypass on trading systemsFull database compromise
HighCVSS 7.0 - 8.9
$10,000 - $50,000SQL injection with data exfiltrationPrivilege escalation to adminSensitive data exposure (PII, financial data)SSRF with significant impactBroken authentication mechanismsServer-side request forgery
MediumCVSS 4.0 - 6.9
$2,500 - $10,000Stored cross-site scripting (XSS)CSRF on sensitive actionsIDOR with meaningful impactInformation disclosureOAuth/OpenID misconfigurationsSession fixation
LowCVSS 0.1 - 3.9
$500 - $2,500Reflected XSSMinor information leakageSecurity header misconfigurationsRate limiting bypassVerbose error messagesMissing best practices
In Scope
rapidtrade.orgWeb ApplicationAll pages and functionality
*.rapidtrade.orgSubdomainsIncluding staging and beta
api.rapidtrade.orgREST APIv2 and v3 endpoints
ws.rapidtrade.orgWebSocketReal-time feeds
iOS AppMobileLatest App Store version
Android AppMobileLatest Play Store version
Smart ContractsBlockchainVerified contracts only
Out of Scope
- ×Third-party services and integrations
- ×Social engineering attacks on employees
- ×Physical security attacks
- ×Denial of service (DoS/DDoS) attacks
- ×Automated scanning without prior approval
- ×Vulnerabilities in outdated browsers
- ×Recently disclosed 0-days (< 30 days)
- ×Attacks requiring MITM or physical access to user device
Submit a Report
Provide as much detail as possible. The more information you include, the faster we can validate and reward.
Encrypted Reports
For sensitive disclosures, encrypt your report with our PGP key.
Fingerprint:
4A7B 9C3D E5F1 2468 ACE0...Response Timeline
- 24 hours: Initial acknowledgment
- 72 hours: Severity assessment
- 14 days: Bounty payment (if valid)
- 90 days: Coordinated disclosure
Other Channels
Email: security@rapidtrade.org
HackerOne: rapidtrade