Trust Token · Vulnerability Disclosure

Trust Token Vulnerability Disclosure

Vulnerability disclosure

Trust Token publishes a vulnerability disclosure policy for reporting security issues. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

CompanyStablecoinsDeFiBlockchainTokenizationLendingCryptocurrencyFintech

Program: security.txt present

Disclosure Policy

Policy

https://github.com/trusttoken/stablecoins-bug-bounty

Policy

https://github.com/trusttoken/bug-bounty

Policy

https://immunefi.com/bounty/truefi/

Security Contact

Contact

security@archblock.com

Contact

security@trusttoken.com

Source

Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: true
notes: TrustToken (now Archblock) publishes two bug bounty programs through its
  GitHub organization. The active Archblock (Poland) Stablecoins Bug Bounty covers
  the 1GBP and 1USD stablecoin smart contracts plus all *.archblock.com websites,
  with awards from 100 USD up to 100,000 USD (capped at 10% of funds directly
  affected). The earlier TrueFi smart-contract bounty was previously hosted on
  Immunefi (currently paused there) with terms maintained in the trusttoken/bug-bounty
  repo. No /.well-known/security.txt is published on archblock.com or
  app.archblock.com (probed 404).
policy:
- https://github.com/trusttoken/stablecoins-bug-bounty
- https://github.com/trusttoken/bug-bounty
- https://immunefi.com/bounty/truefi/
contact:
- security@archblock.com
- security@trusttoken.com
bounty:
  active: true
  programs:
  - name: Archblock (Poland) Stablecoins Bug Bounty
    url: https://github.com/trusttoken/stablecoins-bug-bounty
    scope:
    - '1GBP smart contract eth:0x86B4dBE5D203e634a12364C0e428fa242A3FbA98'
    - '1USD smart contract eth:0x403b0a511AC03851496Eb83a2A0fb5204dcDB241'
    - '*.archblock.com websites'
    rewards: 100-100,000 USD by severity (smart contracts), 100-30,000 USD (websites)
    contact: security@archblock.com
  - name: TrueFi Smart Contract Bug Bounty
    url: https://github.com/trusttoken/bug-bounty
    status: Immunefi listing paused; GitHub terms cover other contracts
    rewards: 100-100,000 USD by CVSS 3.0 severity and capital-loss potential
    contact: security@trusttoken.com
evidence:
- source: https://github.com/trusttoken/stablecoins-bug-bounty
  kind: bug-bounty-repo
  detail: README names security@archblock.com, in-scope assets, and award ranges (pushed 2025-03-03)
- source: https://github.com/trusttoken/bug-bounty
  kind: bug-bounty-repo
  detail: TrueFi bug bounty terms, security@trusttoken.com disclosure contact
- source: https://www.archblock.com/.well-known/security.txt
  kind: security.txt
  detail: HTTP 404 - not published

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/trust-token-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.