Security and responsible disclosure

Contact email: support@darkswap.app — monitored by the DarkSwap team.

Please disclose vulnerabilities privately by email. Include minimal reproduction steps. Do not access other people’s data, move funds or disrupt services. Allow time for investigation and a fix before publication. Never include private keys, recovery phrases or private order receipts.

Bug bounty: open, with a total program budget of US$25,000. Reports must follow this policy to qualify.

In scope: the main site (darkswap.app), the DarkSwap API and DarkPools. The launch site is not in scope.

Does not qualify: issues in third-party providers, social media posts and founder posts.

Rewards: critical vulnerabilities up to US$20,000. Other valid reports start at US$500 and are assessed case by case on severity and complexity; DarkSwap decides each reward.

Payment: in USDC on Solana, within 30 days of confirmation.

Response: DarkSwap replies once a report has been confirmed.