Your Security is Our Priority

At Decentro, we take the security of your financial data and personal information seriously. We employ robust security measures to protect your assets and ensure a safe and secure environment for all your financial transactions.

We work diligently to stay ahead of emerging threats and vulnerabilities. However, we also recognize the importance of a collective community effort to maintain the highest level of security. In case any security researcher or a member of the general public identifies any vulnerability in our systems, and responsibly shares the details of it with us, we appreciate their contribution, work closely with them to address such vulnerabilities with urgency, and if they want, publicly acknowledge their contribution. Decentro reserves all the rights to validate whether the reports are valid or not on the basis of the impact of the vulnerability.

Your contribution to our security is valued and plays a vital role in the continuous improvement of our services. Thank you for helping us maintain a safe and secure financial ecosystem.

To be eligible for recognition, you must

1. Be the first person to disclose the bug responsibly.
2. Report a bug that could compromise our users’ private data, circumvent the system’s protections, or enable access to a system within our infrastructure.

Scope

Decentro - https://decentro.tech

Out of Scope

1. authmanager.decentro.tech
2. base.decentro.tech
3. dashboard.decentro.tech
4. docs.decentro.tech
5. in.decentro.tech
6. monitoring.decentro.tech
7. partner.decentro.tech
8. ping.decentro.tech
9. postman.decentro.tech
10. rule.decentro.tech
11. rule-engine.decentro.tech
12. sea.decentro.tech
13. sentry.decentro.tech
14. strapi.decentro.tech
15. utils.decentro.tech

Reporting Exclusions

1. Vulnerabilities found through automated testing
2. “Scanner output” or scanner-generated reports
3. Publicly released CVE’s or 0-days in internet software within 90 days of their disclosure
4. “Advisory” or “Informational” reports that do not include any Decentro testing or context
5. Vulnerabilities requiring MITM or physical access to the victim’s unlocked device.
6. Denial of Service attacks
   1. SPF and DKIM issues
   2. Content injection
   3. Hyperlink injection in emails
   4. IDN homograph attacks
   5. RTL Ambiguity
7. Content Spoofing
8. Vulnerabilities relating to Password Policy
9. Full-Path Disclosure on any property
10. Version number information disclosure
11. Third-party applications on the Decentro Application directory (identified by the existence of a “Report this app” link on the app’s page). Please report vulnerabilities with these services to the creator of that specific application.
12. Clickjacking on pre-authenticated pages, or the non-existence of X-Frame-Options, or other non-exploitable clickjacking vulnerabilities
13. CSRF-able actions that do not require authentication (or a session) to exploit
14. Reports related to the following security-related headers
15. Strict Transport Security (HSTS)
16. XSS mitigation headers (X-Content-Type and X-XSS-Protection)
17. X-Content-Type-Options
18. Content Security Policy (CSP) settings (excluding nosniff in an exploitable scenario)
19. Bugs that do not represent any security risk
20. Security bugs in third-party applications or services built on the Decentro API – please report them to the third party that built the application or service
21. Security bugs in software related to an acquisition for a period of 90 days following any public announcement
22. HTTP TRACE or OPTIONS methods enabled
23. Non-sensitive (i.e., non-session) cookies missing the Secure or HttpOnly flags
24. Tap jacking
25. Mobile client issues require a rooted device and/or outdated OS version or SSL pinning issues.
26. Subdomain takeovers without supporting evidence
27. Missing best practices in SSL/TLS configuration.
28. The Vulnerabilities that cannot be used to exploit other users or Decentro — e.g., self-XSS or having a user paste JavaScript into the browser console.
29. Open ports without an accompanying proof-of-concept demonstrating vulnerability

Rules of Engagement

At Decentro, we value your assistance and dedicating time in maintaining the security and functionality of our platform. If you've discovered a bug or vulnerability, we appreciate your responsible disclosure and adherence to these rules of engagement:

1. Verify the Issue: Before reporting a bug, please ensure that local configurations, browser settings, or user errors do not cause the issue. Verify that it is a genuine platform bug.
2. Confidentiality: If you discover a security vulnerability, ensure it remains confidential. Do not disclose it publicly or to other individuals.
3. Report Promptly: Please report the bug or vulnerability to us as soon as possible after discovery. This allows us to address it quickly.
4. Responsible Disclosure: Follow responsible disclosure practices. Allow us a reasonable amount of time to fix the issue before disclosing it to others.
5. Provide Details: When reporting a bug, be thorough in your description. Include details such as the steps to reproduce the issue, the environment (e.g., browser and device), and any relevant screenshots or error messages.
6. Report to the Right Channel: Use the designated bug reporting channels provided by Decentro for reporting issues. Do not contact individual employees directly for security-related matters.
7. Legal Compliance: Your bug reporting should be in compliance with all applicable laws and regulations.

Types of Recognition

We do not have a bounty/cash reward program for such disclosures, but we express our gratitude for your contribution in different ways. For genuine ethical disclosures,

1. We provide exclusive Decentro goodies as a token of appreciation.
2. We would also be glad to publicly acknowledge your contribution in the “Hall of Fame” section on our website. Of course, this will be done if you want a public acknowledgement.

Reporting a Security Vulnerability

If you have discovered a security vulnerability or a bug within our platform, we encourage you to report it immediately. Your responsible disclosure of security issues helps us to address and rectify them promptly.

Reporting Process:

If you happen to have identified a vulnerability on any of our web or mobile app properties, we request you to follow the steps outlined below:

1. Please submit the vulnerability report form with the necessary details to recreate the vulnerability scenario. This may include screenshots, videos or simple text instructions.
2. If possible, share with us your contact details (phone number), so that our security team can reach out to you if further inputs are needed to identify or close the problem.
3. If the identified vulnerability can be used to potentially extract information of our customers or systems, or impair our system’s ability to function normally, then please refrain from actually exploiting such a vulnerability. This is absolutely necessary for us to consider your disclosure a responsible one.
4. While we appreciate the inputs of White-Hat hackers, we may take legal recourse if the identified vulnerabilities are exploited for unlawful gains or getting access to restricted customer or system information or impairing our systems.
5. Bug Bounty Program:
   OpenBugBounty

Responsible Disclosure Guidelines

We expect you to adhere to the following guidelines when reporting a security vulnerability:

1. Act Ethically: Do not exploit the vulnerability for personal gain, and do not disclose the issue publicly until it has been resolved.
2. Provide Sufficient Information: Include enough details in your report to help our security team understand and reproduce the issue.
3. Respect User Privacy: Do not access, modify, or delete user data. Only interact with your own accounts for testing.
4. No Malicious Actions: Do not perform any actions that may disrupt the availability or integrity of our services.
5. Legal Compliance: Ensure your actions comply with all applicable laws and regulations.

Hall of Fame

Decentro thanks & congratulates the following people for finding & responsibly disclosing security vulnerabilities in our environment. We are grateful for their contribution & efforts towards the security of Decentro

Join our Bug Bounty program and become a part of our security journey.