Security policy

Vulnerability disclosure: scope, how to report, rules for testing, safe harbor and what to expect.

Swapper welcomes reports of security vulnerabilities from researchers acting in good faith. This page says what is in scope, how to report and what you can expect. The machine-readable contact is /.well-known/security.txt (RFC 9116).

Scope

• The web app and pages at xmrtousdc.xyz, including the discovery documents (/llms.txt, /openapi.json, /.well-known/*).
• The HTTPS API at /api/v1.
• The MCP server at https://xmrtousdc.xyz/mcp and the A2A endpoint at /a2a.
• Swapper's signing: response signatures (/.well-known/jwks.json), order attestations and the offline verifier (/swapper-verify.js).

Out of scope: the swap provider's systems (report those to Wagyu), wallets and AI clients made by others, denial-of-service or volumetric testing, spam, social engineering of people, and physical attacks.

How to report

Email support@xmrtousdc.xyz with "Security" in the subject. Include what you found, the affected URL or tool, steps to reproduce, the impact you expect and how to reach you. Please do not put vulnerability details in a support ticket through the API or in public channels.

Rules for testing

• Do not create orders, fund deposits or move funds. Quotes are read-only and create nothing; use them, the discovery documents and the read endpoints for testing.
• Do not access, change or delete other people's data. If you reach any, stop, do not keep it, and tell us what you saw.
• Do not degrade the service: respect rate limits and Retry-After, and keep automated scanning light.
• Do not use other people's order IDs, tickets or keys, and do not try to trick Swapper's support or operator.
• Give us a reasonable time to fix an issue before you disclose it.

Safe harbor

If you make a good-faith effort to follow this policy, Swapper considers your research authorized, will not pursue or support legal action against you for it, and will not ask the provider or anyone else to do so. If a third party takes action against you for research that followed this policy, Swapper will make it known that your research was authorized by this policy. Swapper cannot authorize testing of systems it does not control, such as the provider's.

What to expect

• Acknowledgement of your report within 3 business days.
• A first assessment (valid or not, severity, next steps) within 10 business days.
• Updates while a fix is in progress, and a coordinated disclosure date agreed with you, by default 90 days after the report or when a fix ships, whichever comes first.
• Credit in the fix notes if you want it. This policy does not promise a reward.

These are targets for a small team, not contractual deadlines. Related: Privacy policy · Terms of service.