Realtap logo

Report a vulnerability

Last updated 13 October 2026

Realtap builds transactions that people sign with their own wallets, so we take security reports seriously and are glad to receive them.

  1. 1. How to report

    Write to [email protected]. Please do not open a public issue or post about a problem before we have had a chance to fix it. Our machine-readable contact is at /.well-known/security.txt.

    Useful to include: what you found and where, the steps to reproduce it (a request, a URL, a short script), what an attacker could do with it, and how you would like to be credited, if at all.

  2. 2. What we do

    • We confirm receipt within a few days and keep you informed while we investigate.
    • We fix confirmed problems as quickly as their severity warrants, and tell you when the fix is live.
    • We do not take legal action against people who look for problems in good faith, stay within the limits below, and give us a reasonable time to fix what they found.
    • We cannot promise a reward. We will thank you publicly if you want that.

  3. 3. What matters most

    • Anything that could make a person sign a transaction that does something other than what the page shows them.
    • Reading or changing another account's data, or signing in as another wallet.
    • Reading the contents of an end-to-end encrypted message.
    • Running code in a visitor's browser (cross-site scripting), or framing the site to trick clicks.
    • Getting around the request limits in a way that harms other users.

  4. 4. Please do not

    • Access, change or delete data that is not yours, beyond what is needed to show the problem.
    • Run tests that degrade the service for others (floods, load tests, automated scanners at high rates).
    • Use social engineering, phishing or physical attacks against anyone, or test third-party services we link to (wallets, exchanges, Cloudflare).
    • Submit or sign real transactions to prove a point. A description or a transaction that was built and not signed is enough.

  5. 5. Out of scope

    • Missing security headers on pages that do not handle anything sensitive, and clickjacking on pages with nothing to click.
    • Reports from automated scanners without a demonstrated impact, and problems that need an already compromised browser or wallet.
    • The public data API being readable from any website: that is intended.
Who operates Realtap

The operator's name and place of establishment will be listed here.

A contact address for questions and requests will be listed here.