Vulnerability Disclosure Policy

Tokenswim takes the security of our platform, customer data, and API gateway seriously. If you believe you have found a security vulnerability in Tokenswim, we want to hear from you. Responsible, coordinated disclosure helps us protect users and improve the Service.

This Vulnerability Disclosure Policy explains how to report issues, what is in scope, the rules of engagement, how we classify severity, when monetary rewards may be offered, and what you can expect from us.

Email security@tokenswim.app with a clear description of the issue. Reports in English or Chinese are welcome. Please include as much of the following as you can:

• The affected URL, endpoint, host, or component.
• Step-by-step reproduction instructions, a proof of concept, or sample requests (with secrets redacted).
• The impact you believe the issue has, who it could affect, and your suggested severity (Critical / High / Medium / Low).
• Any relevant screenshots, logs, or timestamps (with privacy in mind).
• How you would like to be credited, if at all, and any preferred contact for follow-up about a potential reward.

Do not include real customer data, live production secrets belonging to others, or more personal information than needed to demonstrate the issue. A machine-readable pointer to this policy is published at /.well-known/security.txt (RFC 9116).

In scope

The Tokenswim web application and API served from tokenswim.app, including:

• Account, authentication, and session management flows.
• OAuth / OIDC provider endpoints operated by Tokenswim.
• The model gateway and related API routes under Tokenswim’s control.
• Customer dashboards, billing/referral surfaces, and first-party client integrations we operate.
• Issues that can lead to unauthorized access to other users’ data, privilege escalation, authentication bypass, or compromise of payment / credit integrity on Tokenswim-controlled systems.

Out of scope

• Upstream model providers’ own services (OpenAI, Anthropic, and others) — report issues to the respective vendor.
• Third-party payment processors, email providers, or infrastructure vendors outside Tokenswim’s application layer, except where a misconfiguration on Tokenswim’s side is the root cause.
• Social engineering, phishing, or physical attacks.
• Denial of service, volumetric testing, or automated scanning that degrades the service for others.
• Spam, content-policy issues, or findings that require stolen credentials, malware, or attacks on Tokenswim staff or users.
• Issues in outdated browsers, dependency versions without a practical exploit path, missing security headers without demonstrated impact, or purely theoretical concerns without a working proof of concept.
• Reports that only restate publicly documented behavior, or duplicates of issues we already know about or have previously fixed.

We consider research to be in good faith when you:

• Test only with accounts, API keys, and data you own or control.
• Do not access, modify, or delete other users’ data — if a flaw exposes it, stop at the first evidence, do not expand the access, and report promptly.
• Do not disrupt the service, exfiltrate bulk data, or degrade availability for others.
• Do not use social engineering against Tokenswim personnel or customers.
• Give us reasonable time to investigate and remediate — typically up to 90 days from a complete report — before any public disclosure, unless we agree otherwise in writing.
• Handle any data you encounter during research confidentially and delete it when the report is closed, unless law requires retention.

Research that violates these rules may be ineligible for reward and outside the safe-harbor described below.

Tokenswim reviews every valid, in-scope report and assigns a severity based on real-world impact, exploitability, and affected assets — not solely on the reporter’s self-assessment. We use a framework aligned with common industry practice (for example CVSS-style impact thinking and qualitative triage used by mature disclosure programs).

Monetary rewards. For validated, in-scope vulnerabilities, Tokenswim may offer a monetary reward. Whether a reward is paid, and the amount, is determined solely by Tokenswim after triage, based primarily on the assigned severity level, together with report quality, novelty, and business impact. Higher-severity findings that demonstrate clear, reproducible harm are more likely to receive a reward and a larger amount; low-severity or informational issues may receive a smaller reward, public credit only, or no monetary payment.

Eligibility for a monetary reward

In general, a report is more likely to be reward-eligible when:

• It is the first valid report of a previously unknown issue on an in-scope asset.
• It includes a clear, reproducible proof of concept and a credible impact description.
• You complied with this policy’s ground rules and applicable law.
• The issue is confirmed and accepted by Tokenswim (not a duplicate, out-of-scope finding, or previously known/fixed issue).

Tokenswim may reduce or decline a reward for incomplete reports, issues that require unrealistic attacker conditions, chain findings that depend on other bugs already reported, or situations where the same root cause was already under remediation. We may combine related reports into a single severity decision. Reward decisions are final and made at Tokenswim’s sole discretion.

If a reward is approved, we will coordinate payment details with you privately (for example cryptocurrency or another method we support at the time). You are responsible for any taxes or reporting obligations in your jurisdiction. We may require basic identity or payment information solely to process the reward and prevent fraud.

With your permission, we are also glad to credit meaningful, validated reports in release notes or an acknowledgements list, whether or not a monetary reward is paid.

• We aim to acknowledge complete reports within five business days and to keep you reasonably informed as we triage, investigate, classify severity, and fix validated issues.
• After triage we will share our severity assessment and, where applicable, whether a monetary reward is offered. Timelines for payment depend on validation and remediation status.
• Not every report will result in a code change or a bounty; we will explain our assessment when practical.
• If you follow this policy in good faith, Tokenswim will not pursue civil or criminal action against you for the research activities described in your report. This safe-harbor statement is not a waiver of rights regarding activities outside this policy, and it does not bind third parties (for example Model Providers or infrastructure vendors).

For general product or privacy questions that are not security vulnerabilities, contact contact@tokenswim.app. Related policies: Privacy Policy, Terms of Service.