SwapWallet Security & Vulnerability Disclosure Policy

1Scope

1. 1-1
   This policy covers every service Zanjireh Tabdil Soba Co. provides under the SwapWallet name: the swapwallet.app domain and its subdomains, the web app, the Android apps, the Telegram mini app and SwapWallet’s official bots.
2. 1-2
   Programming interfaces are in scope too: the public API (docs.swapwallet.app) and the MCP server at swapwallet.app/mcp, including its OAuth sign-in flow.
3. 1-3
   Third-party services, such as Telegram itself, banks, payment gateways and app stores, are out of scope. If you find a weakness in one of them, report it to that service’s owner.

2How to report

1. 2-1
   Send your report on Telegram to t.me/SwapWalletVIP. A member of SwapWallet’s technical team reads this account directly.
2. 2-2
   Reports are accepted in Persian or English. A good report includes the vulnerable component or URL, exact steps to reproduce, the real impact (who gains access to what) and, where possible, a proof of concept.
3. 2-3
   If proving the issue meant reaching another user’s data, don’t include that data in your report. The type of data and how you reached it are enough.
4. 2-4
   Don’t send vulnerability reports through support. That channel is for account questions, and a security report reaches the technical team later that way.

3Testing rules

Testing that crosses these lines no longer counts as good-faith research:

1. 3-1
   Use only accounts that belong to you. Don’t access, change or move other users’ accounts, data or assets.
2. 3-2
   If you reach data or assets that aren’t yours, stop right there, keep nothing, and report it.
3. 3-3
   Denial-of-service (DoS) attacks, request flooding, spam and automated scanning that puts noticeable load on the service are not allowed.
4. 3-4
   Social engineering, phishing and any deception of SwapWallet staff or users, and physical access to offices and equipment, are not allowed.
5. 3-5
   Output from automated tools without a demonstrated impact, such as a missing security header or SPF and DMARC settings, is not considered a vulnerability.
6. 3-6
   Don’t share the details with anyone until the issue is fixed and its disclosure has been agreed with us.
7. 3-7
   Don’t make a report conditional on payment. Asking for money in exchange for not disclosing is extortion.

4SwapWallet’s commitments

1. 4-1
   We confirm that we received your report, investigate it, and keep you informed of the outcome and of progress on the fix.
2. 4-2
   If the research was done in good faith and within the rules on this page, SwapWallet will not take legal action against the researcher or file a complaint against them.
3. 4-3
   We keep the reporter’s contact details and identity confidential and never name them without their permission.

5Your account’s security

These are not vulnerabilities and should go to support instead:

1. 5-1
   If you think someone has gained access to your account, contact support right away and sign out any device you don’t recognise from the connected devices list in the app’s security settings.
2. 5-2
   Turn on two-factor authentication, so that a password alone isn’t enough to sign in to your account.
3. 5-3
   SwapWallet operates only on the swapwallet.app domain, and its official apps are available only from the download page. SwapWallet staff will never ask for your password or verification code. If you see a fake site or account using the SwapWallet name, send its address to support.