Bug bounty rules
These are the rules for reporting a security problem to Krexa. They are a draft and may change.
Draft, 1 November 2026
Testing is not open yet
Krexa has no staging site. Do not test against the live app yet. You can still report a problem you found by reading public code, public pages or public responses, without trying it on the live app.
Rewards: to be announced.
How to report
Email tejas@krexa.xyz. Give the steps, what you saw, and what you think the impact is. Report privately and give us time to fix the problem before you tell anyone else. The same contact is in security.txt.
Scope
- krexa.xyz and www.krexa.xyz, the web app.
- The Krexa API (api.krexa.xyz).
- The Krexa MCP server (krexa.xyz/mcp).
- Any way to move money out of an agent wallet or Trading account to an address that is not the owner's.
- Any way to act as another user, or to read another user's private data or keys.
Out of scope: venues and wallets Krexa does not run (Hyperliquid, Polymarket, Jupiter, Privy, exchanges), social engineering of Krexa staff or users, and reports from automated scanners with no proof of impact. Read how Krexa holds keys before you report.
What not to do
- Do not use real user funds, and do not touch another user's account or data.
- Do not run denial-of-service tests, load tests or spam.
- Do not place real orders on live venues.
- Do not keep, copy or share private keys or personal data you reach by accident. Stop and tell us.
- Do not publish the problem before we have fixed it.
Safe harbor (draft, needs legal review)
This text is a draft. It is not final and has not been reviewed by a lawyer. Do not rely on it until it is marked final.
Krexa intends not to start legal action against a person who follows these rules in good faith, reports a problem to us, and does not harm users or data. This does not cover anyone who breaks the rules above, and it does not bind other companies.