Bug bounty
Bug bounty
Up to $500 for a critical vulnerability. Small numbers, published honestly, with severity defined by what a finding breaks in our threat model rather than by a generic scoring band.
PrivaMesh has not had an independent security audit. Until it does, researchers looking at the code are the closest thing to external review it gets — which is exactly why this program pays rather than asks for favours.
Critical
$500Breaks a core guarantee
- Read message plaintext without the recipient’s device keys
- Impersonate an account or forge a signed prekey bundle
- Link sender to recipient across a conversation from public data alone
- Drain or debit the fee treasury beyond paying a transaction fee
High
$200Breaks an advertised property
- Link an Apple purchase to a send, defeating the blind-token unlinkability
- Spend one blind token for two sponsored sends
- Recover ratcheted message history from the recovery phrase alone
- Deanonymise a sender through the relay on the anonymous path
Medium
$75Leaks more than we document
- Metadata leak beyond what the limitations page already admits
- Bypass the quota or the per-caller rate limit at scale
- Force the client into the legacy account path without the user acting
Low
$25Real but contained
- Crash or state corruption reachable by a malicious contact
- Keychain or local-storage handling weaker than documented
- Information disclosure with no practical path to the above
How to report
Email privamesh@proton.me with security in the subject line. Include the app version, your device and iOS version, reproduction steps, and what you believe the impact is. Do not open a public issue.
Never include a recovery phrase in a report — yours or anyone else’s. We will never ask for one.
Not eligible: things we already published
These are real weaknesses. They are also already on the limitations page, so reporting them earns thanks rather than a payout.
The session-opening message is recoverable from the recovery phrase
Documented on the limitations page. Identity, signed prekey and PQ prekey are all phrase-derived and no one-time prekeys are published, so a phrase holder can recompute the X3DH root for the first envelope of each conversation. Known, and a protocol change is required to fix it.
There is no user-facing key verification
Documented. Signed bundles stop key substitution by a registry; nothing confirms an account belongs to the person you meant to add. No safety number exists yet.
Cover traffic is off by default
Documented. Decoys spend from the message allowance, so the shipped default is weaker on timing than the maximum configuration.
Ciphertext on the chain is permanent, and transaction timing is public
Documented. Both are properties of using a public chain as the transport, not defects.
The RPC provider sees your IP address
Documented. Pair with a VPN or self-host the endpoint.
Findings in Solana, RPC providers or Apple
Not ours to fix. Report them upstream - though we still want to hear about it if it changes our threat model.
Scope
In scope: the iOS client, the on-chain protocol described on the protocol page, and the fee worker under relay/ in the public repository — including its blind-token issuance, single-spend tracking, quota handling and treasury guard.
Out of scope: Solana itself, third-party RPC providers, Apple platform issues, anything requiring physical access to an unlocked device, social engineering, and denial-of-service. Please do not run automated scanning against the relay — every sponsored transaction it signs costs real money, and a scanner can exhaust the daily cap for everyone.
What we commit to
- Acknowledgement within 2 business days, a severity decision within 7.
- A fix or a written plan within 30 days for critical and high findings.
- Payment on confirmation, not on fix. If we agree it is critical, you are paid whether or not the fix ships quickly.
- Credit if you want it, silence if you do not.
- No legal threats for good-faith research that respects the rules above.
- Publication after a fix ships or 90 days, whichever is first.
Why the amounts are small
Because they are real. PrivaMesh is a small project with no funding behind it, and a published $500 that gets paid is worth more than an advertised range that turns into a negotiation. If the program outgrows these numbers, they go up here first.
Duplicate reports are paid to whoever reported first. Findings already known to us internally are disclosed as such, with the date we recorded them. The security page tracks fixes as they ship.
Frequently asked questions
How much does PrivaMesh pay for a critical vulnerability?
Up to $500 for a critical finding, $200 for high, $75 for medium and $25 for low. These are small amounts by industry standards and we would rather publish real numbers we can pay than advertise a range we cannot.
What counts as critical?
Anything that breaks a core guarantee: reading message plaintext without device keys, impersonating an account, linking sender to recipient from public data, or debiting the fee treasury beyond a transaction fee.
Are the known limitations eligible?
No. Everything already published on the limitations page is out of scope - the first-message recoverability from the recovery phrase, the absence of key verification, cover traffic being off by default, permanent on-chain ciphertext and the RPC seeing your IP. A program that pays for its own published gaps is theatre.
How fast will I hear back?
Acknowledgement within 2 business days, a severity decision within 7, and a fix or a plan within 30 days for anything critical or high. If you do not hear back, assume the mail was lost and resend.
Can I publish my findings?
Yes, after a fix ships or 90 days from your report, whichever comes first. Tell us if you want credit or prefer not to be named. We will not threaten you legally for good-faith research.
What is not allowed?
Testing against accounts or data that are not yours, denial-of-service against the relay or the treasury, social engineering of the maintainer, physical attacks, and automated scanning that costs us sponsored transactions.