Security & vulnerability disclosure

• The affected URL or service and a short explanation of the issue.
• Reproduction steps using accounts and wallets you own, and the potential impact.
• The date, time and time zone, plus relevant browser or app versions.
• Minimal, redacted evidence such as a screenshot or request example.

If evidence is sensitive, describe it first and ask us for a suitable transfer method. Do not attach other users' data.

This policy covers Hilt-controlled application functionality on hilt.so, www.hilt.so, pay.hilt.so, app.hilt.so, api.hilt.so and docs.hilt.so.

Third-party platforms, wallets, partner services, hosting infrastructure outside our control, and blockchain networks or contracts are not authorised testing targets under this policy. Report issues in those systems to their owners. A link from Hilt does not bring a third party into scope.

• Use only accounts, wallets and data you own or have explicit permission to test.
• Use the least invasive proof needed. Do not move funds or assets to demonstrate an exploit, including on mainnet.
• Do not disrupt availability, run denial-of-service tests, brute-force credentials, spam users, or use social engineering or phishing.
• Do not access, change, retain or disclose another person's data. If you encounter it accidentally, stop immediately and tell us without copying it.
• Do not establish persistence or continue exploitation after you have enough evidence to report.
• Ask us before testing anything whose scope or safety is unclear.

We aim to acknowledge reports within three business days. We assess the impact, investigate reproducible issues and coordinate remediation with the reporter. Resolution times depend on severity and complexity; we do not promise a fixed repair deadline.

If you have not heard back, follow up in the same email thread. Please allow us a reasonable opportunity to investigate before publishing exploit details, and agree a disclosure date with us where possible.

Hilt will not initiate legal action against researchers for good-faith security research conducted within this policy. This commitment applies only to Hilt and does not authorise activity against third parties or waive their rights.

This is a coordinated vulnerability disclosure programme, not a paid bug bounty. Rewards are not guaranteed. We will only credit a researcher publicly with their permission.

Machine-readable security contact

Trust and safety

For ordinary payment or account support, use the same support inbox and describe the problem without security-sensitive information.