Nym takes a multifaceted approach to external security, using continuous testing, a crowdsourced vulnerability disclosure program, and regular white-box penetration tests from external firms and our internal security team.
To participate, you must follow these guidelines:
Any significant vulnerability with enough detail and a proof-of-concept may be eligible. Once confirmed, we’ll work to fix it, and you agree to assist in testing fixes if needed.
We acknowledge reports within ~72 hours. We then attempt to reproduce and validate the issue. Reports that are non-reproducible, out of scope, duplicates, or already covered in past Nym audits may be closed without reward.
Rewards in NYM tokens are based on severity. Include your NYM address when submitting a report. You are responsible for taxes. Submissions from countries on prohibited lists (e.g. US sanctions) are ineligible.
Indicative rewards structure:
If you disagree with severity or a rejection, request clarification. We can reevaluate with new info. After reevaluation, the security team’s decision is final.
We encourage coordinated disclosure after a fix is in place.
Do not publicly share details for 60 days after our acknowledgment, unless you coordinate with us.
We may inform affected vendors but will not share your identity without permission.
We won’t pursue legal action against researchers who act in good faith, follow this policy, and avoid unnecessary harm or data access.
We cannot bind third parties. If in doubt, contact us first.
We may share non-identifying details of your report with affected third parties who commit not to take legal action against you. Identifying info is only shared with your permission.
Good faith research that may violate certain terms can be exempt under safe harbor conditions.
Nym will not file civil or criminal actions against compliant researchers. Non-compliance may lead to exclusion or, in severe cases, legal action.
Email bugs@nym.com with questions. If unsure about specific methods, ask before testing. Suggestions for improving this policy are welcome.
Email your findings to bugs@nym.com, ideally encrypting with our PGP key, and include clear, reproducible steps, plus any proof-of-concept code or screenshots.
You will receive a confirmation email once your report is submitted.
Common vulnerabilities like XSS, CSRF, code execution, SQL injection, SSRF, authentication bypasses, and data leaks may qualify, as long as they meet our criteria.
We aim to acknowledge receipt within about 72 hours. After that, we’ll attempt to reproduce and validate the issue before determining if it qualifies for a reward.
Rewards are based on severity and impact, often using a CVSS-based classification. Payouts are made in NYM tokens, and you’ll need to include a valid NYM address in your report.
We encourage coordinated disclosure after we’ve implemented a fix. Please refrain from publicly sharing details for at least 60 days after acknowledgment, unless we agree on an earlier disclosure date.