Vulnerability Disclosure Policy

001K Bot takes the security of its Platform, systems, users, and users' Digital Assets seriously. We value the work of security researchers who help us identify and address potential security vulnerabilities.

If you believe you have discovered a security vulnerability affecting 001K Bot, please report it to us in accordance with this Vulnerability Disclosure Policy (the "Policy").

By conducting security research involving the Platform, you agree to comply with this Policy and the applicable Terms of Use, except to the extent that this Policy expressly permits activities that would otherwise be restricted by the Terms of Use.

1. How to Report a Vulnerability

Please report suspected security vulnerabilities by email to [email protected].

For reports containing sensitive information, we recommend encrypting your communication using our PGP public key:

PGP key:

https://001k.bot/.well-known/security-pubkey.asc

Fingerprint:

FA18 D018 8275 CD97 BC0F 114A B868 16AE 1024 772F

To help us investigate your report efficiently, please include, where applicable:

• the affected URL, endpoint, application, or component;
• a clear description of the vulnerability;
• steps necessary to reproduce the issue;
• the potential or demonstrated security impact;
• relevant screenshots, logs, requests, or other technical information;
• the account ID or API key ID used for testing, where relevant (never provide API secrets, passwords, private keys, seed phrases, or other authentication secrets); and
• your contact details if you would like us to communicate with you regarding the report.

Please do not report vulnerabilities through public channels, social media, or customer support. Security vulnerabilities should be reported exclusively through the dedicated security contact above.

2. Our Commitment

For reports submitted in accordance with this Policy, we aim to:

• acknowledge receipt of the report within 2 business days;
• provide an initial assessment within 5 business days, where reasonably practicable;
• keep the reporter informed of material developments during our investigation and remediation process, where appropriate;
• coordinate responsible disclosure of confirmed vulnerabilities with the reporter where public disclosure is appropriate; and
• provide public recognition to the reporter, where requested and appropriate.

Unless otherwise agreed in writing with the reporter, we aim to investigate and remediate confirmed vulnerabilities within the responsible disclosure period set out in Section 7 of this Policy.

Remediation timelines may vary depending on the complexity, severity, and scope of the vulnerability. Any variation in remediation timing does not, by itself, extend the responsible disclosure period set out in Section 7.

3. In-Scope Systems

This Policy applies to security research concerning the following systems and services operated by or on behalf of 001K Bot:

• Web application — app.001k.bot;
• Website — 001k.bot;
• Public API — api.001k.world, including /api/v1, HMAC-signed requests, and merchant callbacks;
• Official 001K Bot Telegram bot and Mini App, as linked from 001k.bot; and
• 001k-cli and its bundled skill.

We are particularly interested in vulnerabilities that may result in:

• unauthorized access to another user's account, balance, or data;
• unauthorized withdrawals, transfers, swaps, or other movement of Digital Assets;
• bypass of two-factor authentication (2FA), step-up authentication, transaction confirmation, or withdrawal-address security controls;
• API authentication, signature verification, or replay-protection bypass;
• unauthorized balance, transaction, or fee manipulation;
• unauthorized access to or disclosure of KYC, AML, personal, or other confidential data;
• privilege escalation or authentication/authorization bypass;
• server-side injection;
• Server-Side Request Forgery (SSRF);
• Remote Code Execution (RCE); or
• other vulnerabilities capable of materially affecting the confidentiality, integrity, or availability of the Platform or user assets.

4. Out-of-Scope Systems and Findings

The following are outside the scope of this Policy:

• vulnerabilities affecting third-party services or infrastructure not controlled by 001K Bot, including Telegram's own systems and infrastructure, third-party exchanges, KYC/AML providers, and Cloudflare; however, vulnerabilities affecting the official 001K Bot Telegram bot or Mini App itself remain in scope as provided in Section 3. Vulnerabilities affecting third-party systems should be reported directly to the relevant provider;
• denial-of-service (DoS/DDoS), stress, load, or volumetric testing;
• social engineering, phishing, impersonation, or other attacks against employees, contractors, partners, or users;
• physical attacks against offices, infrastructure, personnel, or equipment; and
• findings that do not demonstrate a meaningful security impact.

Examples of findings that will generally not be considered security vulnerabilities include:

• missing security headers or cookie attributes without demonstrated impact;
• clickjacking affecting pages that do not perform sensitive actions;
• self-XSS;
• software or version banners without a demonstrated exploitable vulnerability;
• SPF, DKIM, or DMARC configuration observations without demonstrated security impact;
• rate-limiting observations concerning non-sensitive functionality; and
• automated scanner results that do not include evidence demonstrating an exploitable security impact.

5. Rules of Engagement

When conducting security research under this Policy, you must:

• test only accounts, API keys, wallets, and other resources that you own or are expressly authorized to use;
• not intentionally access, obtain, modify, delete, disclose, transfer, or otherwise interfere with another user's data or Digital Assets;
• immediately stop testing if you inadvertently gain access to another user's data, account, or Digital Assets, and report the issue to us without retaining, copying, downloading, or further accessing such information;
• use only the minimum level of access and activity reasonably necessary to demonstrate the vulnerability;
• not exploit a vulnerability beyond what is reasonably necessary to establish its existence and security impact;
• not attempt to establish persistence or maintain unauthorized access to any system;
• not introduce malware, ransomware, backdoors, destructive code, or other harmful software;
• keep automated testing at a low and reasonable rate and ensure that your testing does not materially degrade the Platform or affect other users;
• not perform denial-of-service, stress, load, or volumetric testing;
• not use another person's identity or KYC documentation for testing;
• keep vulnerability information confidential during the responsible disclosure period set out in Section 7 and refrain from public disclosure during that period, except as otherwise agreed with us in writing; and
• comply with applicable law and this Policy throughout your research.

5.1. Testing involving Digital Assets

You should avoid using real Digital Assets unless doing so is strictly necessary to demonstrate a vulnerability.

Where testing involving real Digital Assets is necessary, you should contact us at [email protected] before proceeding whenever reasonably possible and use only the minimum amount required to demonstrate the issue.

001K Bot does not guarantee reimbursement of Digital Assets or other funds used, transferred, lost, or otherwise affected during security testing unless reimbursement has been expressly agreed by us in writing in advance.

6. Protection of User Data

Security research must be conducted in a manner that minimizes access to personal, confidential, KYC/AML, financial, or transactional information.

If you inadvertently encounter information belonging to another user:

• stop accessing the affected system or data immediately;
• do not download, copy, retain, share, or otherwise use the information;
• securely delete any information inadvertently obtained, where applicable; and
• notify us immediately at [email protected].

Reports should contain only the minimum amount of user or confidential information necessary for us to reproduce and investigate the vulnerability.

7. Responsible Disclosure

Please keep information concerning suspected or confirmed vulnerabilities confidential while we investigate and remediate the issue during the responsible disclosure period described below.

Unless an earlier disclosure date is agreed in writing, we ask researchers not to publicly disclose the vulnerability, publish proof-of-concept materials, or share technical details that could reasonably facilitate exploitation for a period of 90 calendar days from the date on which 001K Bot acknowledges receipt of the vulnerability report.

If the vulnerability is remediated before the end of the 90-day period, we may coordinate an earlier public disclosure with the researcher.

After the 90-day period has expired, the researcher may publicly disclose the vulnerability without further approval from 001K Bot, provided that the researcher has otherwise made a good-faith effort to comply with this Policy.

Where additional time is reasonably necessary to complete remediation safely, 001K Bot may request an extension of the disclosure period. Any extension must be mutually agreed with the researcher in writing before the applicable disclosure period expires.

We ask researchers to coordinate with us before publication where reasonably practicable so that remediation status and any remaining risks can be accurately reflected in the disclosure.

Public disclosure should not include personal data, KYC/AML information, authentication credentials, private keys, confidential information belonging to Users or third parties, or other information obtained through testing that is not reasonably necessary to describe the vulnerability.

8. Safe Harbor

Security research conducted in good faith, including where the researcher makes a good-faith effort to comply with this Policy, will be considered authorized by 001K Bot to the extent expressly permitted by this Policy.

For research conducted in good faith under this Policy, 001K Bot considers such activity to be:

• authorized under applicable computer misuse and anti-hacking laws, including, where applicable, the U.S. Computer Fraud and Abuse Act (CFAA) and equivalent laws in other jurisdictions;
• authorized for purposes of applicable anti-circumvention laws, including, where applicable, Section 1201 of the U.S. Digital Millennium Copyright Act (DMCA) and equivalent laws in other jurisdictions, and 001K Bot will not bring a claim solely for the circumvention of technological measures to the extent reasonably necessary to conduct research authorized under this Policy; and
• exempt, on a limited basis, from provisions of our Terms of Use that would otherwise prohibit security testing, reverse engineering, or similar activities, solely to the extent reasonably necessary to conduct research authorized under this Policy.

Where a researcher makes a good-faith effort to comply with this Policy, 001K Bot will not initiate or support civil or criminal legal action, or make a referral to law enforcement, solely in relation to security research conducted in good faith under this Policy, including an inadvertent, good-faith violation of this Policy.

If legal action is initiated by a third party against a researcher in connection with activities conducted in good faith under this Policy, 001K Bot will, where appropriate and legally permitted, take reasonable steps to make known that the research was conducted with our authorization and that the researcher made a good-faith effort to comply with this Policy.

This Safe Harbor applies only to claims and actions within 001K Bot's control and does not bind independent third parties or law enforcement authorities.

Safe Harbor does not apply to conduct involving intentional harm, extortion or threats, unauthorized retention, use or disclosure of User data or Digital Assets, theft or misappropriation of Digital Assets, deliberate disruption of the Platform, conduct materially exceeding what is reasonably necessary to demonstrate a vulnerability, or other conduct undertaken in bad faith.

Nothing in this Policy authorizes conduct against third-party systems, services, or infrastructure that is outside the scope of this Policy.

If you are uncertain whether a particular activity is permitted, please contact [email protected] before proceeding.

9. Rewards and Recognition

001K Bot does not currently operate a paid bug bounty program, and submission of a vulnerability report does not create any entitlement to payment or other compensation.

However, we may, at our sole discretion, provide a monetary or other reward for reports of significant security vulnerabilities.

Where appropriate, we may also publicly acknowledge researchers who submit valid reports, provided that they consent to such recognition.

Any reward or recognition is voluntary, determined by 001K Bot on a case-by-case basis, and does not create an obligation to provide equivalent compensation for any current or future report.

10. Changes to this Policy

We may update this Policy from time to time to reflect changes to our Platform, security practices, or legal and regulatory requirements.

The current version will be published on the 001K Bot website together with the date of the latest update.