If you find a security problem in bittensor.ai, we want to hear about it. This page says what is covered, how to report it, the rules for testing, and what you can expect from us.
What is in scope
- the website at bittensor.ai, including the routes it serves under /api/;
- the bittensor.ai REST API at api.bittensor.ai;
- the bittensor.ai MCP server at bittensor.ai/mcp, and the signing links it issues.
Out of scope
- test.bittensor.ai and any other staging or preview environment;
- third-party services we link to or embed, such as browser and mobile wallets, SimpleSwap, and Cloudflare. Report those to their owners;
- the Bittensor blockchain, its runtime and its nodes, which are separate open-source projects with their own disclosure channels;
- denial-of-service and volumetric attacks, and spam;
- social engineering, phishing and physical attacks on people or offices;
- output from automated scanners without a demonstrated security impact, such as missing headers on pages that hold no sensitive data.
How to report
Email [email protected]. Please do not report security problems in public issues or on social media. Include:
- the affected URL, API route or MCP tool;
- the steps to reproduce the issue, and what you expected to happen;
- the impact as you understand it, and any proof of concept;
- any accounts, wallet addresses or transactions you used while testing;
- how to reach you, and whether you want to be thanked by name.
What we commit to
- We acknowledge your report within 3 business days.
- We keep you updated while we investigate and fix it, and tell you when it is fixed.
- We credit you once the issue is fixed, if you want to be credited.
Safe harbour
We consider security research carried out in good faith and in line with this policy to be authorised. We will not take legal action against you, or ask anyone else to, for research that follows these rules. If a third party takes action against you for it, we will make it known that your research was authorised. If you are unsure whether something you plan to do is within this policy, ask us first at [email protected].
Rules for testing
- Use only accounts and wallets you own, or test accounts you created. Do not access, change or delete anyone else's data, and never touch funds that are not yours.
- Do not move funds on Bittensor mainnet beyond your own, and keep any transaction you send to the smallest amount that shows the issue.
- If you reach someone else's data, stop at once, do not keep or share it, and tell us what you saw.
- Do not degrade the service for other people.
- Do not disclose the issue publicly until it is fixed, or until 90 days after your report, whichever comes first. If we need longer, we will ask you and explain why.
Rewards
We do not run a paid bug bounty yet. We are grateful for every valid report, and we thank researchers on this page.
Acknowledgments
With your permission, we thank researchers who report valid issues on this page once the issue is fixed.