Security disclosure

Found a hole? Tell us first.

FortFi was built by someone who was drained twice. If you find a way around our locks, we want to hear it before anyone else does. Report it privately, give us time to fix it, and we will thank you, credit you, and pay what we can.

How to report

  1. Email [email protected] with what you found, the steps to reproduce it, and what an attacker could do with it.
  2. We reply within 3 business days and keep you updated until it is fixed.
  3. Give us 90 days to fix it before you publish, or less if we agree. We will credit you publicly if you want.

What we pay

We are a small team, so cash rewards are modest. We add FortFi points on top. Points are a thank-you inside FortFi. They are not money, and we make no promise they will ever convert to anything else.

  • Critical: up to $1,000 plus 50,000 points

    Move or freeze someone else's money, get around the passkey or co-signer, export keys without the owner, or send to an address the owner never approved.

  • High: up to $300 plus 20,000 points

    Get around spend limits, the 24-hour wait on new addresses or exports, or Autopilot's trade-only rule. Read another user's balances, addresses, or activity.

  • Medium: up to $100 plus 5,000 points

    Weaken a security control without reaching money, such as changing another user's settings or bypassing an audit log entry.

  • Low: 1,000 points

    Real issues with limited impact. Missing best practices with no clear attack usually get a thank-you, not a reward.

The first clear report of an issue gets the reward. We decide the level based on real impact, and we will explain our reasoning.

In scope

  • fortfiapp.com

    The web app, its API, and the MCP server.

  • How FortFi uses Turnkey

    Our policies, co-signer checks, and delegated signers. Bugs in Turnkey itself go to Turnkey's own program.

Please do not

  • Touch other people's money or data

    Test only on accounts you own. Stop as soon as you see someone else's data, and tell us.

  • Break the service for others

    No denial of service, spam, or load testing. No social engineering or phishing of our team or users.

  • Keep what you find

    If you move funds by accident, send them back right away. We will treat that as good faith.

Safe harbor

If you follow this page in good faith, we will not take legal action against you or ask anyone else to. If you are unsure whether something is allowed, ask us first.