How do I submit a vulnerability report?

Email your findings to support@nym.com, ideally encrypting with our [PGP key](https://github.com/nymtech/nym/security/policy), and include clear, reproducible steps, plus any proof-of-concept code or screenshots.

Vulnerability disclosure policy and bug bounty program

Frequently asked questions

Email your findings to support@nym.com, ideally encrypting with our PGP key, and include clear, reproducible steps, plus any proof-of-concept code or screenshots.

You will receive a confirmation email once your report is submitted.

We are looking for novel bugs and flaws in our system. Note that common vulnerabilities that are detected by Metasploit or simplistic use of AI systems will not be rewarded, nor vulnerabilities that are outside of our threat model.

We aim to acknowledge receipt within about 72 hours. After that, we’ll attempt to reproduce and validate the issue before determining if it qualifies for a reward.

Rewards are made on a per report basis. We will only reward bugs that are novel and were not detected by us before. We are already actively running AI such as Claude Fable against Nym and will not reward bugs that we have already found and so are in a process of fixing.

We encourage coordinated disclosure after we’ve implemented a fix. Please refrain from publicly sharing details for at least 60 days after acknowledgment, unless we agree on an earlier disclosure date.

1. Guidelines

To participate, you must follow these guidelines:

Do not download, modify, or destroy other users’ data.

Do not cause denial of service (DoS) through exploits, traffic, or provider issues.

Test only with your own account in production, or run your own instance of our open source code.

Social engineering, DDoS, physical access, and similar attacks are out of scope.

Only the first report of a unique issue is eligible for a payout.

Nym decides payouts, severity, classification, and eligibility.

Threats, ransom demands, or unprofessional language disqualify you.

2. How to report a vulnerability ?

Email: security@nym.com (encrypt with our PGP key if possible).

Keep reports confidential and include proof-of-concept code or screenshots if you can.

Provide a detailed technical description, including tools and steps to reproduce. Avoid using LLMs as they tend to be vague.

Attach images or documents with clear names; scripts or exploit code must be in non-executable formats.

We accept common file types and archives (zip, 7zip, gzip).

You may remain anonymous or provide contact info. We may request clarification.

By submitting, you affirm no IP rights violations and grant Nym the right to use your report internally for security purposes.

3. Vulnerability scope

Any significant vulnerability with enough detail should be reported. Once confirmed, we’ll work to fix it, and you agree to assist in testing fixes if needed.

Note that very common bugs should not be rewarded and definitely will not have any reward:

Rate limiting

Stack traces

Self-XSS

Man in the Middle (MiTM) attacks

Denial of Service (DoS) attacks

Cache poisoning

Clickjacking

Missing DNS records

Brute force attacks

Vulnerabilities in third-party services or third-party platforms

Vulnerabilities in past versions of the software

Vulnerabilities affecting outdated browsers or operating systems

Vulnerabilities found in support services (e.g., Zendesk)

4. How do we evaluate vulnerabilities?

Initial review

We acknowledge reports within ~72 hours. We then attempt to reproduce and validate the issue. Reports that are non-reproducible, out of scope, duplicates, or already covered in past Nym audits may be closed without reward.

Severity assessment

Critical (CVSS 9.0-10.0): Direct user privacy compromise, VPN encryption bypass, or account takeover.

High (CVSS 7.0-8.9): Broad security flaws affecting many users, including data leaks.

Medium (CVSS 4.0-6.9): Conditional exploits that may still expose user information.

Low (CVSS 0.1-3.9): Minor, hard-to-exploit issues.

Informational (CVSS 0): Helpful findings, not true vulnerabilities.

5. Rewards and payouts

Nym Technologies will determine rewards at its sole discretion for compenstation of real and novel attacks that require actual mediation by Nym Technologies to ensure user privacy and security. However, Nym Technologies will not give rewards for trivial attacks on our system, including AI attacks that we are doing ourselves. The current rate of unsolicited submission to rewards is less than 1%. Rewards are typically given in $NYM tokens so Include your NYM address when submitting a report. You are responsible for taxes. Submissions from countries on prohibited lists (e.g. US sanctions) are ineligible.

We do very much encourage serious security and privacy researchers to work with us to identify vulnerabilities in our system, and will be happy to give grants or otherwise help work. For example, we have worked with EPFL for a 200k USD grant to inspect and improve our cover traffic system.