Program rules

Program start date: 4 August 2025
Last updated: 13 October 2026

At Azteco, keeping our customers' bitcoin and personal data safe is our top priority. We value the work of independent security researchers, and we reward people who find and responsibly report security vulnerabilities in our products and services.

These rules explain what is in scope, how to report a vulnerability, how rewards work, and what we expect from you. By taking part in the program, you agree to these rules.

Scope

In scope

• azte.co and its subdomains
• The Azteco voucher redemption flow, including voucher codes, referral codes and the rewards program
• Azteco APIs used by our websites and partner integrations
• Lightning and on-chain bitcoin payout flows operated by Azteco

Out of scope

• Third-party services we use (for example hosting, payment or email providers). Please report these to the vendor directly
• Retail partners' and resellers' own websites and systems
• Social engineering or phishing of Azteco staff, partners or customers
• Physical attacks against Azteco offices, staff or vouchers
• Denial-of-service (DoS/DDoS) attacks or volumetric testing

Qualifying vulnerabilities

We are most interested in issues that put customer funds or data at risk, such as:

• Redeeming, duplicating, forging or predicting voucher codes
• Stealing or redirecting bitcoin payouts
• Authentication or authorization bypass
• Remote code execution
• SQL injection and other injection attacks
• Server-side request forgery (SSRF)
• Exposure of customer personal data
• Stored or reflected cross-site scripting (XSS) with real security impact
• Business logic flaws in the rewards or referral systems

Non-qualifying issues

The following are generally not eligible for a reward:

• Reports from automated scanners without a working proof of concept
• Missing security headers, cookie flags or best-practice recommendations without a demonstrated impact
• Clickjacking on pages without sensitive actions
• CSRF on logout or other non-sensitive actions
• Rate-limiting issues without a demonstrated security impact
• SPF, DKIM or DMARC configuration
• Self-XSS
• Software version disclosure or banner grabbing
• Vulnerabilities only affecting outdated or unsupported browsers
• Issues already known to us or reported by someone else

Rewards

Rewards are based on severity, impact and the quality of your report. We use CVSS v3.1 as a guide, but the Azteco security team makes the final decision on severity and reward.

• Critical: $500 – $1,000
• High: $250 – $500
• Medium: $50 – $250

• Low: $10 – $50

• Rewards are paid in bitcoin at the exchange rate on the day of payment
• Only the first person to report a given vulnerability is eligible for a reward
• Multiple issues with the same root cause are treated as one report
• A clear report with reproducible steps and a proof of concept may receive a higher reward
• We may award a bonus for exceptionally well-written reports or creative findings

How to report a vulnerability

Email your report to support@azte.co. Please include:

1. A description of the vulnerability and its potential impact
2. The affected URL, endpoint or product
3. Step-by-step instructions to reproduce the issue
4. A proof of concept (screenshots, video or code)
5. Your name or handle, and a bitcoin address for your reward

Our response times

• First response: within 3 business days
• Triage and severity assessment: within 20 business days
• Reward payment: within 60 days of confirming the vulnerability

We will keep you updated while we work on a fix.

Rules of engagement

When testing, you must:

• Only test against accounts and vouchers that you own or have explicit permission to use
• Not access, modify or delete other people's data. If you accidentally access personal data, stop and report it to us immediately
• Not redeem, spend or keep bitcoin you obtain through a vulnerability. Report it, and return any funds as instructed
• Not disrupt our services or degrade the experience for other users
• Stop testing and contact us if you are unsure whether an action is allowed

Responsible disclosure

Please do not share details of a vulnerability publicly or with third parties until we have fixed it and given you permission. We aim to fix confirmed issues within 90 days. With your agreement, we are happy to credit you publicly once the issue is resolved.

Safe harbor

If you act in good faith and follow these rules, we will not take legal action against you or ask law enforcement to investigate you for your security research. If a third party takes legal action against you for activities that followed these rules, we will make it known that your actions were authorized by this program.

Eligibility

To be eligible for a reward, you must:

• Be the first person to report the vulnerability
• Follow these rules
• Not be a current or former (within the last 12 months) Azteco employee, contractor or partner, or a member of their immediate family
• Not be located in, or a resident of, a country subject to sanctions that would prevent us from paying you
• Be responsible for any taxes on your reward in your country

Changes to the program

We may update these rules or end the program at any time. Changes do not affect reports submitted before the change. The current version of the rules is always available on this page.

Questions

If you have questions about the program, email support@azte.co.