Security

Pocket never holds your bitcoin, but you trust us with your personal data: your identity documents, bank details and bitcoin addresses. We take that seriously, and we know no system is perfect. If you believe you have found a security vulnerability in Pocket, we want to hear from you and will work with you to fix it.

How to report a vulnerability#

Email security@pocketbitcoin.com. You can write in English or German.

To encrypt sensitive details, use our PGP key:

Please include:

  • the affected product or URL (website, web portal, iOS app, Android app, API) and the app version if relevant
  • a description of the issue and its potential impact
  • clear steps to reproduce, or a proof of concept

Please do not report security issues through customer support chat, social media or app store reviews. Those channels are not confidential, and your report may not reach the right people quickly.

Not a vulnerability, but a phishing site, fake app or scam using the Pocket name? Please report it to security@pocketbitcoin.com as well.

What you can expect from us#

  • We will acknowledge your report within 2 business days.
  • We will send you an initial assessment within 5 business days.
  • We will keep you updated at least every two weeks until the issue is resolved.
  • We will tell you when the issue is fixed.
  • We will not take legal action against you if you follow this policy (see Safe harbour).

Scope#

In scope

Out of scope

  • services run by our partners and providers (e.g. banking, payment, email). Please report those to the provider directly.
  • denial-of-service attacks, load testing, spam
  • social engineering, phishing or physical attacks against Pocket staff, offices or customers
  • reports from automated scanners or AI tools without a verified, reproducible proof of concept
  • missing best practices without demonstrated impact, e.g. SPF/DKIM/DMARC configuration, missing security headers, cookie flags on non-sensitive cookies, version or banner disclosure, clickjacking on pages without sensitive actions, self-XSS, CSV injection, rate limiting on non-sensitive endpoints
  • issues that require a rooted or jailbroken device, an outdated OS or browser, or physical access to an unlocked device
  • leaked credentials or data from third-party breaches that you cannot show are valid for Pocket

Rules of engagement#

  • Only test with your own Pocket account or Pocket accounts you have explicit permission to use. Use the smallest possible amounts.
  • Do not access, modify, download or keep other customers' data. If you come across personal data, stop, report it right away and delete it.
  • Never attempt to move, redirect or withhold funds belonging to Pocket or our customers, or change payout addresses or bank details that are not your own.
  • Do not degrade our services or affect other users.
  • Do not run high-volume automated scans.
  • Give us reasonable time to fix the issue before you disclose anything publicly. We aim for 90 days or less and will coordinate the disclosure date with you.
  • Do not demand payment as a condition for sharing details.

Safe harbour#

If you make a good-faith effort to follow this policy, we will consider your research authorised. We will not start or support legal action against you, and if a third party takes legal action against you for activity covered by this policy, we will make it known that you acted with our authorisation. If you are unsure whether something is allowed, ask us at security@pocketbitcoin.com before you go ahead.

This safe harbour applies only to Pocket's own systems. It does not authorise testing of third-party services and does not override laws that apply to you.

Rewards#

We are grateful for every valid report. We do not currently run a formal paid bug bounty. For valid, previously unknown issues with real security impact we may, at our discretion, offer a reward, paid in bitcoin. Reward decisions depend on severity, report quality and impact, and are final. We do not publicly name reporters.

Security