Responsible disclosure

Report a security issue

Found a vulnerability in Uzo? Tell us privately first. We respond fast, credit researchers, and reward valid findings.

security@uzolabs.xyz · PGP available

Critical

Key or phrase extraction, signing without consent, remote fund loss.

First response · 4 hoursFix target · 72 hours

High

Approval or transaction details misrepresented, bypass of lock or Face ID.

First response · 24 hoursFix target · 14 days

Medium

Spoofed site verification, sensitive data in logs, local-only attacks.

First response · 3 daysFix target · 45 days

Low

Hardening gaps, minor info leaks, UI issues with security impact.

First response · 5 daysFix target · Next release

In scope

✓Uzo Wallet for iOS and Android (latest store release and beta)

✓Key generation, storage, backup verification and app lock

✓Transaction, approval and message signing — including the decoding shown to the user

✓Site verification, connection requests and the in-app browser

✓uzolabs.xyz and its APIs (price, swap quotes, bridge status, notifications)

Out of scope

×Bugs in third-party chains, RPCs, DEXs or bridges (report to them)

×Attacks needing an unlocked, rooted or jailbroken device

×Social engineering of Uzo staff or users

×Denial of service and volumetric attacks

×Missing headers or best practices without a working exploit

Ground rules & safe harbor

Test only with wallets and funds you own; use BOT Chain Testnet (968) where you can.

Don’t access other users’ data, and stop as soon as you’ve shown impact.

Give us reasonable time to fix before public disclosure — we’ll agree a date with you.

Act in good faith under these rules and we won’t pursue legal action or ask anyone else to.

Valid reports are credited in release notes (if you want) and eligible for a reward based on severity.

Submit a reportOr email security@uzolabs.xyz — encrypt with our PGP key (fingerprint published at uzolabs.xyz/.well-known/security.txt).