Bug Bounty Program

Responsible Disclosure

• Give us reasonable time to fix the issue before public disclosure (typically 90 days)
• Make a good faith effort to avoid privacy violations, service disruption, and data destruction
• Don't exploit a vulnerability beyond what is necessary to demonstrate it
• Don't access or modify other users' data without explicit permission
• Report the vulnerability to us first before sharing with third parties

Testing Guidelines

• Only test against accounts you own or have explicit permission to test
• Use your own funds or test funds for any financial testing
• Don't perform any testing that could degrade our services for other users
• Stop testing immediately if you discover a critical vulnerability

Safe Harbor

We will not pursue legal action against researchers who:

• Follow our program rules and responsible disclosure guidelines
• Make a good faith effort to avoid privacy violations and data destruction
• Do not exploit vulnerabilities beyond what is necessary for demonstration
• Report vulnerabilities to us directly

Out of Bounds

Activities that are not authorized include:

• Any form of denial of service testing
• Accessing or attempting to access other users' data
• Social engineering attacks against our employees or users
• Physical attacks against our infrastructure or personnel
• Spam or phishing capabilities
• Any illegal activities

Submit your report via our secure PGP-encrypted form:

security@monxobank.com

PGP Key: Use our PGP key (fingerprint: 8B4E 9C2A 3D5F 6B7C) for sensitive disclosures. We respond within 24 hours.