Reporting a security problem

If you believe you have found a way to take, freeze or expose someone’s funds or keys in M5wallet, we want to hear from you before a user does.

Email info@m5dex.com with “security” in the subject. That address is also published in /.well-known/security.txt.

What we commit to

• We acknowledge within 3 working days. If you have not heard back in that time, assume the mail went astray and send it again.
• We tell you what we found, including when we disagree with your assessment and why.
• We will not threaten you, or ask your internet provider or employer about you, for a report made in good faith under the rules below.
• We credit you on this page if you would like to be credited, once a fix is released. Say so in your report; anonymity is equally fine.

What we ask

• Give us a reasonable chance to fix it before publishing. We will agree a date with you rather than ask for silence indefinitely.
• Use your own accounts and your own funds. Do not touch anyone else’s wallet, data or balance.
• No denial of service, no spam, no social engineering of our users or staff, and no physical attacks.
• Do not run automated scanners against our production services. They cost us real money in RPC calls and tell you little; ask and we will discuss a target.

In scope

The wallet applications (Android, iOS, the browser extension, the desktop app and the web wallet), the services under *.m5wallet.com, the Fast Vault co-signer, the ceremony relay, and the published release artefacts — including whether a build is what it claims to be.

Reports about our threshold signing, the server-held share of a Google sign-in wallet, or anything that lets one party sign alone are the most valuable thing you can send us.

Out of scope

• Missing hardening headers, TLS configuration grades and similar findings with no path to an actual impact. Tell us anyway if you like, but they are not treated as vulnerabilities.
• Anything requiring a rooted or jailbroken device, a malicious operating system, or physical possession of an unlocked phone.
• The macOS build not being notarized, and the Windows build not existing. Both are known and stated on the download page.
• Denial of service, and findings that only affect the marketing site.

What we do not offer yet

There is no bug bounty. We do not want to imply a payment we have not budgeted. If your report leads to a fix we will say so publicly and credit you, and we will tell you honestly whether a paid programme exists by the time you ask. We would rather publish that limitation than have you discover it after doing the work.

Our own view of where the risk is

We publish what we have and have not verified in a 100-point checklist, in our own words, including the items marked FAIL. No independent security audit of the threshold signing scheme has been completed. If you are deciding where to spend your time, that is where we would look.