Security Matters. Help us protect the future of finance.

Byte Federal operates a suite of bitcoin and crypto products used by thousands of people worldwide, including Bitcoin ATMs, a custodial and a non custodial crypto wallet and a POS sale system. If you've found a vulnerability, report it responsibly.

Report a Vulnerability Read Program Rules

In-Scope Targets

Focus your research on these public-facing systems. We take security seriously and want to ensure real impact.

In-Scope

  • Byte Federal Website

    bytefederal.com + official subdomains

  • ByteWallet

    Mobile app + backend infrastructure

  • ByteVault

    Non-custodial mobile wallet

  • ByteConnect Services

    Public-facing services (once launched)

  • ATM Software

    Excluding physical tampering

Out-of-Scope

  • Internal Tools

    Employee-only systems

  • Physical ATM Damage

    Hardware tampering or damage

  • Social Engineering

    Phishing, pretexting, etc.

  • DoS/DDoS Attacks

    Availability-based attacks

Only public-facing systems are eligible. Test responsibly and respect our scope guidelines.

Bug Bounty Rewards

Rewards are discretionary and based on severity, impact, and report quality. We reward responsibly disclosed, valid bugs that affect real users.

CRITICAL
0
-
0

Remote Code Execution, Authentication Bypass, Complete System Compromise

HIGH
0
-
0

Significant Security Flaws with High Impact

MEDIUM
0
-
0

Moderate Security Issues with Limited Impact

LOW
0
-
0

Minor Security Issues and Information Disclosure

What We Value

Impact
Vulnerabilities that affect real users and business operations
Quality
Clear, detailed reports with steps to reproduce
Responsibility
Disclosed through proper channels without public exposure
Novelty
First-time discoveries, not duplicates or known issues

Critical Issues

May receive higher payouts based on impact and exploitability

Payment Options

Crypto or fiat payments depending on availability

Recognition

All valid reports receive acknowledgment and recognition

Duplicate reports, automated scanner results, and low-quality submissions will not receive rewards.

Program Rules

Follow these guidelines to ensure your research is productive and stays within acceptable boundaries.

Required Guidelines

  • Respect scope limitations
  • Only test your own assets and accounts
  • Maintain minimal impact on services
  • Keep reports private until fixed
  • Provide clear reproduction steps
  • Report through official channels only

Do NOT Do

  • Physical attacks on ATMs or hardware
  • Social engineering or phishing attempts
  • DDoS, DoS, or brute-force attacks
  • Test outside of approved scope
  • Exploit vulnerabilities beyond proof-of-concept
  • Exfiltrate data beyond what's needed for the report

Important Guidelines

Privacy First

Do not access, modify, or disclose customer data. Use test accounts only.

Responsible Testing

Avoid any actions that could disrupt service or harm users.

Single Submission

Don't submit the same issue multiple times or through multiple channels.

Professional Conduct

Maintain professional communication and ethical behavior throughout the process.

How to Submit

Submit your vulnerability report through our secure channel. Include all necessary details for a thorough review.

Easy Form Submission

Fill out the structured form below for organized reporting

Guided Format

Form ensures all necessary details are included

Direct to Security Team

Reports go directly to our security team for review

Submit Vulnerability Report

Help us secure our systems by reporting security vulnerabilities responsibly.

By submitting this report, you confirm that you have followed our responsible disclosure guidelines and that this vulnerability was discovered through authorized testing of in-scope systems only.

What Happens Next?

1

Initial Review

We'll acknowledge receipt within 48 hours

2

Investigation

Our team will reproduce and assess the issue

3

Resolution

We'll fix the issue and determine any rewards

Safe Harbor

We support ethical security research and will not pursue legal action against good faith security researchers.

Good Faith Research

We protect ethical hackers

If you act in good faith and follow our program rules, Byte Federal will not pursue legal action against you for security research activities.

We Support

  • Ethical security research
  • Responsible disclosure practices
  • Professional vulnerability reporting
  • Testing within defined scope

Not Extortion

We don't tolerate bad actors

Our safe harbor does not apply to extortion attempts, threats, or malicious activities designed to harm our business or users.

We Will Pursue Legal Action For

  • Extortion or blackmail attempts
  • Public disclosure before resolution
  • Malicious data theft or damage
  • Violating our program rules

Legal Framework

Authorization

This bug bounty program grants you authorization to test the systems explicitly listed in our scope, provided you follow all program rules and guidelines.

Limitations

This authorization is limited to security research activities and does not extend to any other activities or systems not explicitly mentioned in our scope.

Cooperation

We reserve the right to contact law enforcement if we believe malicious activity is taking place, but we will work with researchers who are operating in good faith.

Questions about our safe harbor policy? Submit your inquiry through our secure form

Found something critical?

Your report could help secure the Bitcoin economy. We appreciate responsible researchers who help us protect our users.

Report a Vulnerability Review Scope

Professional

We treat security researchers as partners

Responsive

Initial response within 48 hours

Rewarding

Compensation for valid critical issues