TetherBuy - Bug Bounty Policy

tetherapi, Inc. (also referred to as “tetherapi,” “we,” “us,” or “our”) takes steps to improve our product and provide secure solutions for our customers. In this Bug Bounty Policy (“Policy”), we describe applicable cases for our Bug Bounty Program and how it should be used in connection with your use of our website at https://tethertransfer.online/, including, but not limited to, the tetherapi Wallet, online Tether trading platform, mobile application, social media pages, or other online properties (collectively, the “Website”), or when you use any of the products, services, content, features, technologies, or functions we offer (collectively, the “Services”). This Policy is designed to help you obtain information about how you can participate in our Bug Bounty Program, which secure research results are applicable, and which benefits you can receive. Please note that our Service offerings may vary by region.

For all purposes, the English language version of this bug bounty policy shall be the original, governing instrument. In the event of any conflict between the English language version of this bug bounty policy and any subsequent translation into any other language, the English language version shall govern and control.

What is the Bug Bounty Program?

In order to improve tetherapi and the Services, the tetherapi Bug Bounty Program provides our users an opportunity to earn a reward for identifying technical issues.

How can you communicate your Bug Bounty Program findings to us?

All such communications should be directed to bugbounty@tetherbuy.net. In your submission please specify full description of the vulnerability and verifiable proof that the vulnerability exists (explanation / steps to reproduce / screenshots / videos / scripts or such other materials).

Program Rules

Test vulnerabilities only against an account that you own or accounts that you have consent from the account holder to test against.
Never use a finding to compromise/exfiltrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
If sensitive information such as personal information, credentials, etc.. is accessed as part of a vulnerability, it must not be saved, stored, transferred, accessed, or otherwise processed after initial discovery.
Researchers may not, and are not authorised to engage in any activity that would be disruptive, damaging or harmful to tetherapi.
Researchers may not publicly disclose vulnerabilities (sharing any details whatsoever with anyone other than authorized tetherapi employees), or otherwise share vulnerabilities with a third party, without tetherapi's express permission.

How do we evaluate issues identified under the Bug Bounty Program?

All findings are evaluated using a risk-based approach.

Non-Disclosure Agreement

Before we begin discussing any details related to confirmed issues that you have identified under the Bug Bounty Program, including compensation, etc., you will be required to enter into a Non-Disclosure Agreement with us.

How do we pay Bug Bounty Program rewards?

All such rewards are paid by tetherapi. All rewards can be paid only if they are not contrary to applicable laws and regulations, including but not limited to trade sanctions and economic restrictions.

How long will it take us to analyze your Bug Bounty Program findings?

Due to the varying and complex nature of technical issues, we have not established particular timelines for analyzing findings under the Bug Bounty Program. Our analysis is finished only when we have confirmed the existence or absence of a vulnerability.

What cases are excluded from the Bug Bounty Program?

Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:

More Information

If you are looking for more information regarding this Policy, you may contact us by emailing privacy@tetherbuy.net.