Security

Vulnerability Disclosure Policy
Last updated: October 28, 2026

How to report

Send your report to [email protected]. If someone is actively exploiting the issue, start the subject line with “URGENT”. Please include:

• what the issue is and where it is (app version and platform, URL or API endpoint);
• clear steps to reproduce it, and a proof of concept if you have one;
• the impact you believe it has; and
• how to reach you, and whether you would like to be credited.

If you need to send sensitive details encrypted, tell us in your first email and we will share a key.

What to expect from us

• We confirm we received your report within 3 business days.
• We send our first assessment within 10 business days.
• We keep you updated while we work on a fix, and tell you when it is released.
• With your permission, we thank you by name once the issue is fixed.

We may offer a reward for a valid, original report at our discretion, depending on its severity and impact. Rewards are not guaranteed, and we can’t pay a reward where the law doesn’t allow it, including to people subject to sanctions.

In scope

• The Kantan Wallet apps for iOS and Android, current release versions.
• Our servers and APIs that the apps use.
• This website.

We are especially interested in issues that could expose private keys or recovery phrases, unlock encrypted backups, let someone sign or approve a transaction without the user’s consent, bypass a safety check or the lookalike-address block, show a false recipient, amount or fee, or reveal one user’s data to another.

Out of scope

• Vulnerabilities in third-party protocols, blockchains, swap or bridge providers, Hyperliquid, or websites you connect to. Please report those to their owners.
• Attacks that need physical access to an unlocked device, a jailbroken or rooted device, or malware already installed on the device, unless Kantan makes the impact worse.
• Social engineering or phishing of our users or of anyone working with us.
• Denial of service, load testing, spam, or anything that degrades our services.
• Reports from automated scanners without a demonstrated, practical impact, such as missing security headers or clickjacking on pages with no sensitive actions.
• A safety check that doesn’t flag a particular site or token, unless you show a way to defeat the check itself. You can still report a scam site or token to us so we can add it to our lists.

Rules for research

• Use only your own wallets, accounts and devices. Don’t access, change or move anyone else’s data or assets.
• Use the smallest amounts needed to show the issue, and use test networks where you can.
• Stop and tell us as soon as you have shown the issue. Don’t keep, share or use any data you come across.
• Give us reasonable time to fix the issue before telling anyone else. We ask for 90 days, or less if we agree a date with you.
• Don’t ask for payment in exchange for not disclosing an issue.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not bring legal action against you, or ask law enforcement to act against you, for that research, including under the Computer Fraud and Abuse Act or the anti-circumvention rules of the Digital Millennium Copyright Act. If someone else takes legal action against you for research that followed this policy, we will make it known that your research was authorized.

This safe harbor covers only systems we own or control. It doesn’t authorize testing of third-party systems, and it doesn’t override the law where you are. If you aren’t sure whether something is allowed, ask us first.