Please read this policy carefully.
01Programme status
A paid bug bounty programme, reward schedule and testing scope have not yet been published. Reporting an issue does not guarantee payment.
This page invites reports; it is not blanket authorisation to test or access systems. Obtain written scope and permission before conducting active security testing.
02What to report
Report suspected flaws affecting Zellic-controlled services, such as access-control failures, exposure of sensitive data or unsafe transaction handling. Include the affected URL or feature and the potential impact.
Exchanges and other third-party services are outside our authority to authorise. Report issues in those services to their respective owners.
03Keep research safe
Use only accounts and data you own or have explicit permission to use. Use the smallest safe demonstration necessary; do not move real funds, access other users' records, damage data or disrupt availability.
Do not perform denial-of-service attacks, social engineering, credential attacks or automated high-volume scanning. Stop immediately if you encounter private data or an unexpected risk, and report what happened without further access.