zkMe · Vulnerability Disclosure

Zkme Vulnerability Disclosure

Vulnerability disclosure

zkMe runs a self-hosted bug bounty program documented in its resources section. No third-party platform (Immunefi / HackerOne / Bugcrowd) is used; reports go to the security contact and payouts are made in USD/USDC/USDT.

zkMe runs a coordinated vulnerability disclosure program on Hackerone. A dedicated security contact is published.

CompanyCrypto Web3IdentityKYCKYBComplianceZero KnowledgeDecentralized IdentityAnti-SybilTransaction Monitoring
Program: Hackerone

Disclosure Policy

Policy
https://docs.zk.me/hub/explore/bounty

Security Contact

Contact
contact@zk.me

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://docs.zk.me/hub/explore/bounty
probe: false
description: >-
  zkMe runs a self-hosted bug bounty program documented in its resources
  section. No third-party platform (Immunefi / HackerOne / Bugcrowd) is used;
  reports go to the security contact and payouts are made in USD/USDC/USDT.
policy: [https://docs.zk.me/hub/explore/bounty]
contact: [contact@zk.me]
response_time: 48 hours
testing_scope: private testnets only
poc_required: true
rewards:
  - severity: Critical
    amount: "$5,000-$10,000 (1% of assets at risk)"
  - severity: High
    amount: "$2,000-$5,000 (1% of assets at risk)"
  - severity: Medium
    amount: "$500-$2,000 (1% of assets at risk)"
  - severity: Low
    amount: "$500"
out_of_scope:
  - Theoretical risks without PoC
  - Previously exploited attacks
  - Attacks requiring leaked credentials
  - DoS / traffic-related attacks
  - Oracle issues (excluding manipulation / flash loans)
  - 51% attacks, Sybil attacks
evidence:
  - source: https://docs.zk.me/hub/explore/bounty
    kind: bug-bounty-page