Security & vulnerability reports
Any security finding, from a typo in a header to a full account-takeover chain. Our machine-readable policy lives at /.well-known/security.txt per RFC 9116.
Responsible disclosure: tell us and give us ninety days before publishing. We will not take legal action against good-faith research that stays within swapnokyc.io and its subdomains and avoids destructive testing. We credit reporters in release notes on request. No paid bounty yet.