How to report
Email info@zcan.dev with the subject line “Security”. Please include:
- The affected page, URL or API route.
- Steps to reproduce the problem, and what you expected to happen.
- The impact: what an attacker could do with it.
- Any proof-of-concept, screenshots or logs, with no real user data in them.
- How we can reach you for follow-up questions.
In scope
- The website at
www.zcan.devandzcan.dev. - Its API routes under
/api/.
Out of scope
- Third-party services Zcan relies on, such as NEAR Intents (1Click), Coinbase, CoinGecko, Blockchair, Reown (WalletConnect), the AI provider and wallet apps. Please report those to the service directly.
- Social engineering or phishing of Zcan’s team or users.
- Volumetric denial of service and load testing.
Please
- Don’t access, change or delete other people’s data. If you reach any by accident, stop and tell us.
- Use only your own addresses and small test amounts.
- Don’t degrade the service for anyone else.
- Give us reasonable time to fix the problem before you disclose it publicly. We’ll agree on a date with you.
Safe harbor
If you act in good faith and follow this policy, we will treat your research as authorized, we won’t take legal action against you for it, and we won’t ask anyone else to. If you’re unsure whether something is allowed, email us before you try it.
What to expect
We aim to acknowledge reports within 3 business days. We’ll keep you posted while we look into it and tell you when it’s fixed. If you’d like, we’ll credit you once the fix is live.
There’s no paid bug bounty program yet.
Machine-readable contact
Contact details are also published at /.well-known/security.txt (RFC 9116).