Bug Bounty Program

Last updated: May 17th, 2026

Introduction

The Keystone Bug Bounty Program is designed to encourage security research into Keystone hardware and firmware, and to reward researchers for their valuable contributions to the security of all Keystone users.

Eligibility

To be eligible for a reward under this program, the reported security vulnerability must meet the following general requirements:

The vulnerability must be original and previously unreported.
The vulnerability must be part of Keystone’s own code and not solely caused by third-party code, applications, services, or websites.
You must not be an employee, contractor, vendor, or otherwise have a business relationship with Keystone or any of its subsidiaries.
You must not exploit the vulnerability for personal gain, including unauthorized access, data extraction, asset movement, service disruption, or any other harmful activity.
Before publicly disclosing any part of the security issue, you must give Keystone a reasonable amount of time to validate, fix, and coordinate disclosure of the issue.
Keystone reserves the right, at its sole discretion, to determine whether a reported issue is valid, in scope, sufficiently severe, and eligible for a bounty.

In-Scope Vulnerabilities

Examples of vulnerabilities that may be considered in scope include:

Bypass of password protection, PIN verification, or similar user authentication mechanisms.
Arbitrary code execution on the Secure Element.
Arbitrary code execution on the MCU without physical access.
Bypass of user confirmation, or misleading the user into approving an unintended transaction.
Leakage or extraction of private key material, seed phrases, or other sensitive cryptographic secrets.
Remote code execution affecting Keystone hardware, firmware.

Out-of-Scope Vulnerabilities

Examples of vulnerabilities that are out of scope include:

Vulnerabilities in third-party applications, websites, services, libraries.
Reports without sufficient supporting evidence, such as a working proof-of-concept project, reproduction steps, debug output, logs, or tool output.
Vulnerabilities on Keystone websites, unless they directly lead to a vulnerability in Keystone hardware or firmware.
SPF, DKIM, or DMARC configuration issues.
Missing CSRF tokens, unless there is evidence of an actual sensitive user action that can be exploited.
Denial-of-service attacks.
Spam, phishing, social engineering, or clickjacking-only reports.
Theoretical attacks without a practical exploitation path.
Reports that only claim a vulnerability without a clear technical explanation, reproducible evidence, or a working PoC.

Responsible Disclosure Policy

Keystone strongly supports good-faith security research into our products and wants to encourage responsible disclosure.

As a result, Keystone will not threaten or bring legal action against anyone who makes a good-faith effort to comply with this Bug Bounty Program, or for any accidental or good-faith violation of this policy.

As long as you comply with this policy, Keystone waives any restrictions in our applicable Terms of Service that would otherwise prohibit your participation in this program, solely for the limited purpose of conducting authorized security research under this policy.

You must not publicly disclose, share, sell, transfer, or otherwise reveal your findings, exploit details, proof of concept, or the contents of your submission to any third party without Keystone’s prior written approval.

Submission Requirements

All vulnerability submissions must include both:

A working proof-of-concept project
A detailed vulnerability report

Reports that do not include both of these items may be rejected as incomplete.

Proof-of-Concept Requirement

Your submission must include a working proof-of-concept project that demonstrates and verifies the claimed vulnerability.

The PoC should be sufficient for Keystone to reproduce the issue in a reasonable testing environment. Where applicable, please include:

Source code, scripts, test files, or project files required to reproduce the issue.
Build and run instructions.
Required dependencies, versions, and environment details.
Input files, payloads, QR codes, transaction data, or other test materials.
Expected result and actual result.
Any logs, screenshots, videos, or debug output that help verify the issue.

A report that only describes a possible issue, without a working PoC project or reliable reproduction method, may not be eligible for a bounty.

Vulnerability Report Requirement

Your vulnerability report must provide a clear and detailed description of the claimed vulnerability.

The report should include, at minimum:

A clear summary of the vulnerability.
The affected product, component, firmware version, commit hash, or environment.
A detailed technical explanation of the root cause.
Step-by-step reproduction instructions.
A description of the security impact.
The attacker model and required conditions for exploitation.
Whether physical access is required.
Whether user interaction is required.
Whether the vulnerability can lead to private key leakage, unauthorized signing, transaction manipulation, authentication bypass, remote code execution, or other security impact.
Any limitations or assumptions of the PoC.
Suggested mitigations, if available.

The vulnerability report must explain why the reported behavior is a real security vulnerability, not only unexpected behavior, a crash, or a theoretical concern.

Submission Process

Please send a PGP encrypted email to security@keyst.one.

Please start with a clear-text message containing your public key, and we will reply appropriately.

Your submission should include:

A working proof-of-concept project that reproduces the issue.
A detailed vulnerability report describing the claimed vulnerability, root cause, reproduction steps, and potential impact.
Your name, organization, or Twitter/X handle for attribution, if you would like to be credited.

Keystone will respond within 7 working days to confirm receipt of your initial contact and begin triage of the reported vulnerability.

After our first response, Keystone will respond to subsequent communications regarding the same report no later than 2 working days from receipt, unless both parties agree otherwise or exceptional circumstances apply.

During the validation process, Keystone may ask follow-up questions or request additional information if any part of the vulnerability, PoC, impact, or reproduction process is unclear.

Keystone will keep you informed during the validation, remediation, and coordinated disclosure process.

For valid vulnerabilities, Keystone will work with you to establish a reasonable coordinated disclosure timeline. Keystone may request additional time if more investigation, mitigation, testing, or release coordination is required.

Reward

The decision to grant a reward for a valid vulnerability is at Keystone’s sole discretion.

The amount of each bounty is based on factors including, but not limited to:

Severity of the vulnerability.
Classification and sensitivity of the impacted data.
Practical exploitability.
Required attacker capabilities.
Whether physical access is required.
Whether user interaction is required.
Impact on user assets, private keys, transaction integrity, or product security.
Completeness and quality of the vulnerability report.
Quality and reliability of the working proof-of-concept project.
Overall risk to Keystone users and the Keystone brand.

Bounties will be paid directly to the researcher using Bitcoin.

You are responsible for any tax implications, as determined by the laws of your jurisdiction of residence or citizenship.

Keystone may modify the terms of this program or terminate this program at any time without prior notice.

Supported Wallets & Coins

Basic Information

Affiliate Program

Strategic Partner

Limited Editions

Bug Bounty Program

CART