Bug Bounty Policy

Paxful, Inc. (also referred to as “Paxful,” “we,” “us,” or “our”) takes steps to improve our product and provide secure solutions for our customers. In this Bug Bounty Policy (“Policy”), we describe applicable cases for our Bug Bounty Program and how it should be used in connection with your use of our website at https://paxful.com/, including, but not limited to, the Paxful Wallet, online Bitcoin trading platform, mobile application, social media pages, or other online properties (collectively, the “Website”), or when you use any of the products, services, content, features, technologies, or functions we offer (collectively, the “Services”). This Policy is designed to help you obtain information about how you can participate in our Bug Bounty Program, which secure research results are applicable, and which benefits you can receive. Please note that our Service offerings may vary by region.





All such communications should be directed to [email protected] In your submission please specify full description of the vulnerability and verifiable proof that the vulnerability exists (explanation / steps to reproduce / screenshots / videos / scripts or such other materials).

Program Rules

Violation of any of these rules can result in ineligibility for a bounty.

  • Test vulnerabilities only against an account that you own or accounts that you have consent from the account holder to test against.
  • Never use a finding to compromise/exfiltrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
  • If sensitive information such as personal information, credentials, etc.. is accessed as part of a vulnerability, it must not be saved, stored, transferred, accessed, or otherwise processed after initial discovery.
  • Researchers may not, and are not authorised to engage in any activity that would be disruptive, damaging or harmful to Paxful.
  • Researchers may not publicly disclose vulnerabilities (sharing any details whatsoever with anyone other than authorized Paxful employees), or otherwise share vulnerabilities with a third party, without Paxful's express permission.










Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:

  • 迷惑メール
  • Vulnerabilities that require social engineering/phishing;
  • DDOS攻撃
  • Hypothetical issues that do not have any practical impact;
  • 第三者のアプリケーションおよびPaxfulを統合した第三者ウェブサイトのセキュリティ脆弱性
  • Scanner output or scanner-generated reports;
  • 自動テストによって発見された問題
  • Publicly-released bugs in Internet software within 30 days of their disclosure;
  • Man-in-the-Middle attacks;
  • Host header injections without a specific, demonstrable impact;
  • Self-XSS, which includes any payload entered by the victim;
  • Login/logout CSRF;


このポリシーに関するより詳細な情報が必要な場合は、[email protected] までメールでお問い合わせください。