Security

Write to security@mishmar.io. For the code in the open-source repository you can also use GitHub’s private reporting: the repository’s Security tab, then Report a vulnerability. A good report has:

• what you found and where: a page, an API call, a command, a commit or a release;
• the steps or code that show it, and what an attacker would gain;
• for anything about orders, the decision id from the console and the venue’s order or fill id.

Don’t send key shares, private keys or anyone else’s data. Anything that isn’t a vulnerability goes to support@mishmar.io.

An order that should not have been signed

A trade past an account’s limits, around an approval, or with no allowed decision behind it in the ledger.

A key share that leaks

Either half of a trading key, or anything that gives one away, such as a presigning slot used twice. From the agent’s signer, Mishmar’s signer service or the two-party signing code.

Acting as someone else

Reading or changing another person’s account, agents, rules, keys or approvals.

A ledger that lies

A decision that can be changed, dropped or forged without the chain showing it.

That covers this website, the consoles and their API, Mishmar’s signer service, and the open-source signer, CLI and SDKs. The repository’s SECURITY.md lists its packages, including our presigning change to Coinbase’s cb-mpc. How a trading key is split describes what each side checks before it signs.

• Use the testnet console, app.testnet.mishmar.io, with users, accounts and keys of your own. It runs the same code as the real-money service, so a flaw found there counts the same. Don’t test against app.mishmar.io.
• Don’t touch anyone else’s account, keys or data. If you come across them, stop, keep nothing, and tell us.
• Don’t degrade the service for others: no denial of service, load testing or heavy automated scanning.
• No social engineering, phishing or physical attacks, on us or on our users.
• We can only authorize testing of what is ours. Hyperliquid, Binance and the providers we run on have their own rules; report flaws in them to them.

• Output from automated scanners, with no attack that uses it.
• Missing headers, cookie flags or email settings (SPF, DKIM, DMARC), with no impact shown.
• Clickjacking on pages with no action to take.
• A position that drifts past a cap because the market moved, or a fill within the slippage the docs describe.
• Flaws in cb-mpc outside our change: those belong to Coinbase, under its security policy.

• We acknowledge your report within a day.
• We reproduce it, tell you what we found, and keep you posted until it is fixed.
• We credit you by name in the release notes or the write-up, unless you would rather not be named.
• We agree with you when it can be made public, normally within 90 days of your report. Please don’t publish before then.

If you make a good-faith effort to follow this page:

• we consider your research authorized, and we will not take legal action against you or report you to law enforcement for it;
• it does not break our Terms of Service, which allow testing within these limits;
• if someone else takes legal action against you over it, we will make it known that we authorized it.

If you aren’t sure whether something is allowed, ask at security@mishmar.io before you try it. This covers only what Mishmar Inc. runs; it can’t authorize testing of the exchanges or anyone else.

We don’t run a paid bug bounty yet; every valid finding gets a credit. Until 13 December 2026, 23:59 UTC, the Break the limits contest pays up to $500 for getting a trade past an account’s limits on testnet. Its rules add to this page.