Examples we want to see
- Remote code execution
- SQL injection
- Authentication or authorization bypass
- Account takeover
- Privilege escalation
- Server-side request forgery
- IDOR and access-control flaws
- Sensitive-data exposure
Security Program
GroveX Bug Bounty Program
We invite independent security researchers and ethical hackers to responsibly identify and disclose vulnerabilities affecting GroveX products, applications, APIs and publicly accessible infrastructure.
Program scope
In-Scope Assets
Testing is permitted only against GroveX-owned, publicly accessible assets listed below.
grovex.io and www.grovex.io
Official GroveX web platform
Public and authenticated APIs
Official WebSocket endpoints
Official Android application
Official iOS application
Authentication and authorization
2FA and account recovery
Withdrawal and API-key security
Private infrastructure, internal IP addresses and systems not explicitly listed are not authorized for testing.
Eligible findings
Eligible Vulnerabilities
Reports must demonstrate a meaningful security impact.
Exchange-specific impact
- Withdrawal or deposit manipulation
- Trading-system or business-logic vulnerabilities
- 2FA bypass or session hijacking
- API-key compromise
- API authentication vulnerabilities
- XSS or CSRF with demonstrated impact
Rewards
Reward Structure
Final rewards depend on severity, impact, exploitability, report quality and affected systems.
| Severity | Reward | Typical examples |
|---|---|---|
| Critical | Up to US$5,000 | Critical infrastructure compromise, unauthorized fund movement, RCE |
| High | US$1,000–$3,000 | Account takeover, major auth bypass, major sensitive-data exposure |
| Medium | US$250–$1,000 | Moderate authorization, XSS/CSRF or API issues with proven impact |
| Low | US$50–$250 | Low-impact misconfigurations or limited information disclosure |
Rules
Responsible Testing
- Use accounts you own or have explicit permission to use.
- Minimize access to personal or confidential information.
- Stop testing if unintended customer-data access occurs.
- Do not move funds that do not belong to you.
- Do not make persistent changes to production systems.
- Provide enough detail for GroveX to reproduce the issue.
Restrictions
Prohibited Testing
- DoS or DDoS
- Destructive testing
- Social engineering or phishing
- Credential stuffing
- Spam or extortion
- Testing third-party infrastructure
- Public disclosure before coordinated remediation
Responsible disclosure
Reporting & Response
Send reports to security@grovex.io with clear reproduction steps and evidence.
Include in your report
- Affected URL, endpoint, application or service
- Clear vulnerability description
- Step-by-step reproduction instructions
- Proof of concept, screenshots or request/response evidence
- Security impact
- Preferred name or alias for Hall of Fame recognition
Response targets
- Acknowledgement: within 2 business days
- Initial triage: within 5 business days
- Severity assessment: within 10 business days
- Reward decision: normally within 15 business days after validation
Transparency
Program Transparency
GroveX will maintain public statistics and researcher recognition as the program develops.
~30Reports from other channels
100HackenProof submissions
US$25,000+Rewards paid via other channels
US$350HackenProof rewards paid
Historical figures are shown by channel to avoid double-counting across reporting sources.
Hall of Fame
No qualifying researchers published yet. Researchers may choose to be recognized by name, alias or professional profile.
Safe Harbour
GroveX considers good-faith security research performed in accordance with this policy to be authorized and will not initiate legal action solely for compliant testing under this program.
Security team
Found a security issue?
Send the GroveX security team a responsible disclosure.