Active · paid in ZEC

Bug Bounty

We would rather pay a researcher to tell us about a flaw than have it found the hard way. Rewards are paid in ZEC from a transparent pool you can verify on-chain, and scaled by real-world impact — not by how the issue sounds on paper.

Phase 2 starts on October 5, 2026, the day of the public release.

This page is the whole program. The English text governs.

Report a vulnerability Read the threat model

Reproduce it before you report it

Submit an issue you have personally reproduced, with a working proof of concept (PoC) and evidence of a security impact covered by this program.

Reports without reproducible evidence, speculative claims and proposed test plans will be closed without investigation or an individual reply. We do not develop or test an exploit on your behalf.

Required evidence and response policy

Bug Bounty: Phase 2 (from October 5, 2026)

The bounty continues after the public release. From October 5, 2026, rewards are set in US dollars and paid in ZEC at the market rate on the day of payout, from the same public pool anyone can verify on-chain.

Rewards are paid until the pool is exhausted. When it runs out, the bounty ends; there is no top-up. If sales cover our starting costs, we will put a fixed share of sales toward the bounty and an independent audit.

Z-Text itself hasn't had a third-party audit yet. This bounty is our open invitation to test it.

Reward pool

0 ZEC

Funded and verifiable on-chain.

t1bV6TkNwWBGBPtGhJCNEQZChpGVivHhHGE

Verify on the explorer

Where an attack may start

The program covers the Z-Text app only; our website, its API and our servers are outside it. We reward attacks from two starting points only. The one exception is marked below.

Remote. You have no access to the target's device, system account, backups or seed phrase.
Device in hand. You hold the device with Z-Text locked and use only Z-Text's own screens.

You may use any tool to find a flaw. The attack itself must work from one of these two starting points.

What we reward

Critical

$1,500

Remote starting point only.

Reading another person's messages.
Recovering another person's seed or private keys.
Taking another person's funds, or moving coins out of a wallet we control.
Running your code in another person's app.

High

$750

Device in hand: opening locked Z-Text without the PIN, or Z-Text still showing the wallet or messages after the panic PIN was entered.
Remote: linking the sender and the recipient of a message from blockchain data alone.
Producing a license or receipt that the unmodified app accepts as signed by us.
The one exception to the starting points: message text, the seed or private keys that Z-Text itself writes to disk as plain, unencrypted data. Data held in the operating system's key store does not count.

Medium

$250

A result of the kinds above with a clearly smaller effect, from the same starting points.

Found something as serious that is not listed? Send it. Whether we reward it, and how much, is our decision.

Amounts are in US dollars, paid in ZEC at the market price when sent, to a shielded ZEC address you provide.

Payouts so far

Every reward we have paid, with its date, severity, the terms it was paid under and its transaction. Check any of them on-chain.

Date

Severity

Finding

Transaction

2026-06-11

Low · 0.1 ZEC · Phase 1

CAPTCHA ordering on the invoice endpoint (coordinated disclosure).

4a0ce2385a…6aa24d

What we do not reward

Our website, its API and our servers, including z-text.com and all its subdomains, checkout, payments and vouchers.
Apart from that one exception, anything that needs more than the two starting points: another program or command run on the device, a debugger, root or jailbreak, a modified app, a backup or copy of the device's storage, or the seed phrase.
Guessing a PIN or password.
What the operating system keeps or shows: notifications, screenshots, app previews, the clipboard, the app's name in system lists.
What the panic PIN and Wipe Wallet leave in place by design. They erase everything Z-Text keeps for the account on the device: the seed phrase, private keys, messages, contacts and settings; the app then starts fresh with new, empty files. They do not touch backup files you saved yourself, such as a .ztbk file on a USB stick or in cloud storage, or copies the operating system makes outside the app: notification history, system backups and storage snapshots.
What a network observer or the operator of the node you connect to can see.
Getting past tamper, root or screenshot checks on its own, or unlocking paid features on your own device without producing a receipt.
Stealth mode: it is a cover, not a lock.
Settings and install information that are not message content.
Free offers, promotions, vouchers, referral rewards, payment tolerances and rounding, and anything that only costs us fees or availability.
CAPTCHA, rate-limit and lockout findings.
Behaviour described in our documentation, issues we already know about, and known flaws in third-party components.
UI and functional bugs (please still send them as normal bug reports), denial of service, missing security headers, scanner output and social engineering.
Services we do not build: payment processors, Cloudflare, the BitcoinZ and Zcash networks, and the standard lightwalletd behind light.z-text.com.

Required evidence and response policy

Reports without reproducible evidence, speculative claims and proposed test plans will be closed without investigation or an individual reply. We do not develop or test an exploit on your behalf.

A report takes its place once it is complete: the result you achieved, steps we can repeat on an ordinary device, and proof. Anything earlier holds no date.
It must work on the newest public release on our Downloads page on the day you report. A fix we ship afterwards because of your report does not disqualify it.
Include the exact app version and build, download source, OS and device, prerequisites, numbered steps, expected and observed results, and any payloads, scripts or files needed to reproduce. Supply logs, screenshots or a recording showing the actual result; a video alone does not replace written steps. Use test data and never send a real wallet seed or private key.
Binary strings, table names, decompiled code, architecture descriptions, scanner output and AI-generated claims without a reproduced security impact are not a PoC. Hypothetical impact or “dynamic confirmation required” does not demonstrate a finding.
Keep follow-ups in the same email thread. Resubmit a closed or incomplete report only with new reproducible evidence. Repeated claims or payment requests without new evidence will receive no reply.
If we cannot reproduce it, it is closed. No answer from you within 14 days closes a report.

How to submit

Send your report by email to [email protected]. A plain email is fine; PGP encryption is optional and entirely up to you — we never require it. For complete, in-scope reports with reproducible evidence, we aim to acknowledge within 72 hours and coordinate disclosure from there. This target does not apply to incomplete, speculative or out-of-scope submissions.

Rules

Test only the app, on your own devices and with your own wallets. Do not test our website, its API or our servers. Do not access, change or destroy data that is not yours, run denial-of-service tests, or social-engineer anyone.
Report privately first. Publishing before we agree ends eligibility.
Team members and contractors are not eligible.
We will not pursue legal action against good-faith research that follows these rules.

How we decide

We decide whether a report qualifies, whether it is a duplicate, its severity and its reward. Matching the words of a listed result is not enough; we assess what was actually achieved.
One reward per underlying cause, as we determine it, across all platforms, versions and variants. A chain of steps is one finding. The first complete report receives it.

Payment and changes

Rewards are paid in order of acceptance, from this pool only, in ZEC at the market price when sent. If the pool cannot cover a reward in full, the reporter receives what is left and the program ends.
Times are UTC. A report is received when it arrives complete at [email protected].
We may change or end the program. A report is assessed under the text published on the day it arrived complete.

Terms history

June 4 to October 4, 2026: Phase 1. 0.1 to 3 ZEC per finding, from a 7 ZEC pool.
From October 5, 2026: Phase 2, amounts in USD. ZEC rose from about $430 to about $1,500, so the same ZEC tiers were paying roughly three and a half times what we intended. Reports received before October 5 are paid on Phase 1 terms.
From October 10, 2026: this page states in full which results are rewarded and from which starting points. Reward amounts are unchanged; the credit-only Low tier is retired. Reports received earlier are assessed under the earlier text.
From October 14, 2026: the program covers the Z-Text app only. Our website, its API and our servers are out of scope, and the two server results under Critical and High are removed. Reward amounts are unchanged. Reports received earlier are assessed under the earlier text.
From October 16, 2026: the page states what the panic PIN and Wipe Wallet erase and what they leave in place: backup files you saved yourself and copies the operating system makes outside the app. Reward amounts are unchanged. Reports received earlier are assessed under the earlier text.
From October 26, 2026: evidence requirements and the response policy are explicit. Reports without reproducible evidence and repeated claims without new evidence receive no individual reply. The 72-hour acknowledgment target applies only to complete, in-scope reports with reproducible evidence. Reward amounts and scope are unchanged. Reports received complete earlier are assessed under the earlier text.
Every payout is listed with its date, severity, the terms it was paid under and its transaction.

Want the full picture — threat model, encryption design, and what we openly do not protect against?

Read Security & Transparency