{"id":"cbdae4b1-7182-44d4-98ad-c839a8e61c80","engagementId":"34f1a0dc-5d79-40f7-989a-f0b047b5f4b7","data":{"brief":{"id":"e94de5e2-fb64-40d3-8ad1-3c46d383e8f8","name":"Hemi Labs VDP","tagline":"The future of Bitcoin is programmable. Hemi is the network that’s scaling Bitcoin beyond money.","description":"\u003cp\u003eHemi is a modular protocol for superior scaling, security, and interoperability, powered by Bitcoin and Ethereum.\u003c/p\u003e\n\n\u003cp\u003eAt Hemi Labs, we consider security a fundamental part of our network. We value the security of our network and our users, however no matter how much effort we put into security, there could still be vulnerabilities hiding.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003cp\u003eThis is an open-scope vulnerability disclosure program. Any asset that demonstrably belongs to or is operated by Hemi Labs is in scope, whether or not it is listed in the targets section. This includes subdomains and services you discover through your own research, as long as you can show they belong to Hemi Labs.\u003c/p\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhere a target group provides a testnet environment, please test against testnet rather than production wherever possible.\u003c/li\u003e\n\u003cli\u003eYou are testing on production. Behavior that compromises the stability or integrity of a production target is out of scope for testing.\n\n\u003cul\u003e\n\u003cli\u003eFor example, do not target other users' data (use one of your own additional accounts), do not delete, remove, or edit parts of the site, engage in any form of DoS attack, and do not compromise a target's ability to function for other users. If you believe you have found a vulnerability of this nature, stop further testing and report it.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eWhen testing HTTP-based targets, \u003cstrong\u003eyou must identify your traffic\u003c/strong\u003e by sending a \u003ccode\u003eX-Bugcrowd-Research: your_bugcrowd_username@bugcrowdninja.com\u003c/code\u003e HTTP header with every request, including requests from any automated tools. This lets us contact you if your testing causes problems, and improves our ability to triage reports involving HTTP requests. Reports involving HTTP endpoints are only in scope if this header was set during testing, unless it was genuinely not possible to do so, in which case explain why in your report.\u003c/li\u003e\n\u003cli\u003ePotential post-exploitation scenarios: If you believe you have identified a vulnerability that may lead to post-exploitation activity, including modification or destruction of data, stop testing and submit your finding. We will work with you to evaluate the vulnerability and ward you based on the final impact and severity.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eReport Guidelines\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eReports must contain a clear explanation of the issue and its security impact, along with detailed steps to reproduce it. If the issue cannot be reliably reproduced from your report, it may be closed as not reproducible.\u003c/li\u003e\n\u003cli\u003eDo not submit more than one vulnerability per report. Where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained.\u003c/li\u003e\n\u003cli\u003eWe do not accept low-effort submissions, including reports generated by AI with no meaningful human input. Submissions must demonstrate original analysis, a clear understanding of the issue, and actionable detail. If AI tools were used at any stage of your research or in writing the report, disclose this in the submission. Disclosing AI assistance does not count against you. It helps us triage accurately and reduce spam. Reports that are wholly or partly AI-generated without disclosure may be rejected.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eRecognition\u003c/h2\u003e\n\n\u003cp\u003eThis is a vulnerability disclosure program. It does not offer monetary rewards or points-based compensation.\u003c/p\u003e\n\n\u003cp\u003eWe offer merch at our discretion for valid reports. When we do, you will receive a link to claim it. Claiming requires providing your details to our fulfilment partner, Fourthwall, Inc., and is subject to Fourthwall's \u003ca href=\"https://hemi.store/pages/terms-of-service\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eterms of service\u003c/a\u003e and \u003ca href=\"https://hemi.store/pages/privacy-policy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eprivacy policy\u003c/a\u003e. We cover the cost of the merch and shipping. We do not cover customs, import fees, or taxes, which are your responsibility.\u003c/p\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAssets in scope are generally publicly accessible.\u003c/p\u003e\n\n\u003ch2\u003eCredentials\u003c/h2\u003e\n\n\u003cp\u003eCredentials are not required and will not be provided for testing.\u003c/p\u003e\n\n\u003cp\u003eSome testing requires a wallet. In these cases, use a reputable wallet such as Rabby or MetaMask, generate your own key, and fund it from a testnet faucet. Use a fresh key dedicated to testing rather than a wallet holding real funds. We do not provide tokens for testing, and we advise testing against testnet wherever possible.\u003c/p\u003e\n\n\u003ch2\u003eFocus Areas\u003c/h2\u003e\n\n\u003cp\u003eTo support your testing, we’ve highlighted several key areas of interest. We ask that you report any findings related to these areas, but testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eRPC endpoints\u003c/li\u003e\n\u003cli\u003eExplorer\u003c/li\u003e\n\u003cli\u003ePortal\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eN-day / Third-party Vulnerability Policy\u003c/h2\u003e\n\n\u003cp\u003eReport publicly disclosed N-day vulnerabilities as soon as you can confirm they affect a Hemi Labs asset, so we can prioritize patching.\u003c/p\u003e\n\n\u003cp\u003eWe also want to hear about vulnerabilities in third-party or open-source software we self-host, including upstream issues present in our forks. If you discover a genuine 0-day in software we run, we want the report, and we ask that you also coordinate disclosure with the upstream maintainers, since the issue likely affects others running the same software.\u003c/p\u003e\n\n\u003ch2\u003eLeaked Credentials\u003c/h2\u003e\n\n\u003cp\u003eSubmissions related to leaked or exposed credentials (for example, dark web forums or credential dumps) will be reviewed on a case-by-case basis. The use of any leaked credentials during testing is strictly prohibited and may result in removal from the program.\u003c/p\u003e\n\n\u003ch2\u003eExcluded Submission Types\u003c/h2\u003e\n\n\u003cp\u003eSome behaviour that looks like a finding is intentional and documented as a known non-issue. Review our \u003ca href=\"https://docs.hemi.xyz/feedback/contact#out-of-scope-notes\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eOut-of-Scope notes\u003c/a\u003e before reporting. For example, the \u003ccode\u003etxpool_*\u003c/code\u003e JSON-RPC methods on op-geth are intentionally exposed and out of scope for information-disclosure reports.\u003c/p\u003e\n\n\u003cp\u003eThe following are also excluded:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eP5 vulnerabilities\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvailability or volumetric testing, for example:\n\n\u003cul\u003e\n\u003cli\u003eDoS / DDoS / Network DoS\u003c/li\u003e\n\u003cli\u003eRate limiting bypass attempts\u003c/li\u003e\n\u003cli\u003eEmail bombing or flooding\u003c/li\u003e\n\u003cli\u003eLarge-scale automated vulnerability scanning or automated tools that produce excessive amounts of traffic\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAll forms of social engineering - especially attacks targeting Hemi Labs employees, contractors, or our support/moderation teams.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our \u003ca href=\"https://bugcrowd-support.freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eFreshdesk Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"f65342b4-97e3-4cda-9f1d-33af2668e3d9","name":"Hemi Network RPC","targets":[{"id":"1606215d-41c7-4cbc-a523-a2f94b50818f","uri":"https://rpc.hemi.network/rpc","name":"https://rpc.hemi.network/rpc","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"530c8926-84ef-453a-9cb5-6988a402f48a","sortOrder":0},"sortOrder":0,"tags":[{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"1606215d-41c7-4cbc-a523-a2f94b50818f"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"1606215d-41c7-4cbc-a523-a2f94b50818f"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"1606215d-41c7-4cbc-a523-a2f94b50818f"}],"recentChangeFlags":null},{"id":"c664b36a-90d6-4fba-8cbc-4431baa08ecd","uri":"https://rpc.hemi.network/wsrpc","name":"https://rpc.hemi.network/wsrpc","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1f0895b4-a99a-4ce4-b70d-1324d0a90d3b","sortOrder":1},"sortOrder":1,"tags":[{"id":"537a37bb-0fd5-4cb3-88b3-d08fac588565","name":"Websockets","targetId":"c664b36a-90d6-4fba-8cbc-4431baa08ecd"},{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"c664b36a-90d6-4fba-8cbc-4431baa08ecd"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"c664b36a-90d6-4fba-8cbc-4431baa08ecd"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"c664b36a-90d6-4fba-8cbc-4431baa08ecd"}],"recentChangeFlags":null},{"id":"f8dcbc3f-20b6-4ea0-bebf-c7644ff0b7ae","uri":"https://rpc.hemi.network/noderpc","name":"https://rpc.hemi.network/noderpc","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b7ef8c49-92ad-484d-9955-c2ffceda5246","sortOrder":2},"sortOrder":2,"tags":[{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"f8dcbc3f-20b6-4ea0-bebf-c7644ff0b7ae"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"f8dcbc3f-20b6-4ea0-bebf-c7644ff0b7ae"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"f8dcbc3f-20b6-4ea0-bebf-c7644ff0b7ae"}],"recentChangeFlags":null},{"id":"398ba0ac-e0cc-4794-ba7f-cacc814f3516","uri":"https://testnet.rpc.hemi.network/rpc","name":"https://testnet.rpc.hemi.network/rpc","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c6aecd2d-4695-4885-a8c6-0c8363a69f94","sortOrder":3},"sortOrder":3,"tags":[{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"398ba0ac-e0cc-4794-ba7f-cacc814f3516"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"398ba0ac-e0cc-4794-ba7f-cacc814f3516"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"398ba0ac-e0cc-4794-ba7f-cacc814f3516"}],"recentChangeFlags":null},{"id":"19b5fe31-9b01-4200-a3e6-b6b372b70ab4","uri":"https://testnet.rpc.hemi.network/wsrpc","name":"https://testnet.rpc.hemi.network/wsrpc","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d25c8855-ba34-4edb-adeb-a47dcc85c3fa","sortOrder":4},"sortOrder":4,"tags":[{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"19b5fe31-9b01-4200-a3e6-b6b372b70ab4"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"19b5fe31-9b01-4200-a3e6-b6b372b70ab4"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"19b5fe31-9b01-4200-a3e6-b6b372b70ab4"}],"recentChangeFlags":null},{"id":"38dfc1e9-cf33-41c8-87d6-1efce908b7aa","uri":"https://testnet.rpc.hemi.network/noderpc","name":"https://testnet.rpc.hemi.network/noderpc","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"afbfa6c1-b603-4ab0-90ca-67e370955937","sortOrder":5},"sortOrder":5,"tags":[{"id":"7784ab1d-952b-4432-9460-1e59702a6bb3","name":"JSON-RPC","targetId":"38dfc1e9-cf33-41c8-87d6-1efce908b7aa"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"38dfc1e9-cf33-41c8-87d6-1efce908b7aa"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"38dfc1e9-cf33-41c8-87d6-1efce908b7aa"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eOur network RPC nodes are used by Ethereum wallets to query data and submit transactions to the network.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen possible, testing should only be performed against the testnet network.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eSource code:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/op-geth\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eop-geth: \u003ccode\u003e/rpc\u003c/code\u003e and \u003ccode\u003e/wsrpc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/optimism/tree/hemi/op-node\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eop-node: \u003ccode\u003e/noderpc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eExclusions\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003etxpool_*\u003c/code\u003e JSON-RPC methods on op-geth are intentionally exposed and out of scope for information-disclosure vulnerabilities. \u003ca href=\"https://docs.hemi.xyz/feedback/contact#txpool_-json-rpc-methods-on-op-geth-are-intentionally-exposed\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eSee the reasoning here.\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"a7b60261-c2cf-4452-819f-423d107648b3","name":"Hemi Applications","targets":[{"id":"fff1e4a8-ed85-4816-b891-beff3fce8ad3","uri":"https://app.hemi.xyz/","name":"https://app.hemi.xyz/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"02e6b6af-4477-4a38-a95b-46156cea8a99","sortOrder":0},"sortOrder":0,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"fff1e4a8-ed85-4816-b891-beff3fce8ad3"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fff1e4a8-ed85-4816-b891-beff3fce8ad3"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"fff1e4a8-ed85-4816-b891-beff3fce8ad3"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"fff1e4a8-ed85-4816-b891-beff3fce8ad3"}],"recentChangeFlags":null},{"id":"007bb91b-b8dc-4abe-bdc1-4cda4092be09","uri":"https://explorer.hemi.xyz/","name":"https://explorer.hemi.xyz/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"812042de-915f-4549-9990-138a1c06768f","sortOrder":1},"sortOrder":1,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"007bb91b-b8dc-4abe-bdc1-4cda4092be09"},{"id":"780e37af-990f-47c8-84cc-9b7e10b33066","name":"Elixir","targetId":"007bb91b-b8dc-4abe-bdc1-4cda4092be09"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"007bb91b-b8dc-4abe-bdc1-4cda4092be09"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"007bb91b-b8dc-4abe-bdc1-4cda4092be09"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"007bb91b-b8dc-4abe-bdc1-4cda4092be09"}],"recentChangeFlags":null},{"id":"b146c4a1-4462-43ba-bb6d-a58eb0a88a4c","uri":"https://bitcoin-kit.hemi.xyz/","name":"https://bitcoin-kit.hemi.xyz/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"38bd55cb-e09e-4f23-a99a-0c795a9a5d99","sortOrder":2},"sortOrder":2,"tags":[{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b146c4a1-4462-43ba-bb6d-a58eb0a88a4c"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b146c4a1-4462-43ba-bb6d-a58eb0a88a4c"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"b146c4a1-4462-43ba-bb6d-a58eb0a88a4c"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"b146c4a1-4462-43ba-bb6d-a58eb0a88a4c"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eHemi\u0026#39;s web applications are the primary access point of the Hemi Network. Applications are used to tunnel funds onto the network, view block and transaction information, and interact with the network.\u003c/p\u003e\n\n\u003cp\u003eSource code:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/ui-monorepo\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003eapp.hemi.xyz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/blockscout\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003eexplorer.hemi.xyz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/bitcoin-kit-demo\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003ebitcoin-kit.hemi.xyz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"cc4e86d6-f87a-4a01-928f-f6c2bc3bd848","name":"Hemi Applications APIs","targets":[{"id":"3e2581d0-80a1-4618-9ab9-ba98a7a65975","uri":"https://portal-api.hemi.xyz/","name":"https://portal-api.hemi.xyz/","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"39013aa8-9a0d-492b-b384-a0ab19f7a909","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"3e2581d0-80a1-4618-9ab9-ba98a7a65975"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"3e2581d0-80a1-4618-9ab9-ba98a7a65975"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThese are the APIs used by the core Hemi Applications. They power the frontend applications listed in the \u0026quot;Hemi Applications\u0026quot; group.\u003c/p\u003e\n\n\u003cp\u003eSource code:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/hemilabs/ui-monorepo/tree/main/portal-backend\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003eportal-api.hemi.xyz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"64567510-bb81-48de-8ca1-72d0e701a820","name":"Hemi Marketing Websites","targets":[{"id":"a5b8efce-7bab-4ef8-a7ad-67be26430a91","uri":"https://hemi.xyz/","name":"https://hemi.xyz/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0f1b26fd-5dc3-4870-9c36-cbfbe246c526","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"a5b8efce-7bab-4ef8-a7ad-67be26430a91"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a5b8efce-7bab-4ef8-a7ad-67be26430a91"}],"recentChangeFlags":null},{"id":"22dc91e0-4b1c-462a-a82d-041d8942c924","uri":"https://umami.hemi.xyz/","name":"https://umami.hemi.xyz/","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"eb7db50e-3fd0-46bc-aa7c-b01a072bb5e6","sortOrder":1},"sortOrder":1,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"22dc91e0-4b1c-462a-a82d-041d8942c924"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"22dc91e0-4b1c-462a-a82d-041d8942c924"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThis scope encompasses Hemi\u0026#39;s marketing web assets.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ehemi.xyz\u003c/code\u003e is our marketing website, hosted by Framer.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eumami.hemi.xyz\u003c/code\u003e is a self-hosted instance of \u003ca href=\"https://github.com/umami-software/umami\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eUmami Analytics\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"5fa46703-0694-41f2-9a17-22e978578d82","name":"Hemi Source Code","targets":[{"id":"a5b1cfdd-7022-4a08-81b3-6de4362d7a10","uri":"https://github.com/hemilabs/heminetwork","name":"https://github.com/hemilabs/heminetwork","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7d5b0ef3-28f2-4e0e-8aa7-32e61f050591","sortOrder":0},"sortOrder":0,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"a5b1cfdd-7022-4a08-81b3-6de4362d7a10"},{"id":"80ac7b70-7adf-4684-ab9b-e7f0362596fc","name":"Dockerfile","targetId":"a5b1cfdd-7022-4a08-81b3-6de4362d7a10"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"a5b1cfdd-7022-4a08-81b3-6de4362d7a10"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"a5b1cfdd-7022-4a08-81b3-6de4362d7a10"}],"recentChangeFlags":null},{"id":"63eec45b-5a73-46b7-857c-fb7bdaac705e","uri":"https://github.com/hemilabs/ui-monorepo","name":"https://github.com/hemilabs/ui-monorepo","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"62c4132d-da37-42c3-8ea0-f230b7c6f476","sortOrder":1},"sortOrder":1,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"63eec45b-5a73-46b7-857c-fb7bdaac705e"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"63eec45b-5a73-46b7-857c-fb7bdaac705e"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"63eec45b-5a73-46b7-857c-fb7bdaac705e"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"63eec45b-5a73-46b7-857c-fb7bdaac705e"}],"recentChangeFlags":null},{"id":"ae992fb3-d252-417c-b8fd-c36e1ca862eb","uri":"https://github.com/hemilabs/optimism","name":"https://github.com/hemilabs/optimism","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"abc012d5-21db-4477-979b-7ec7e7c203b6","sortOrder":2},"sortOrder":2,"tags":[{"id":"80ac7b70-7adf-4684-ab9b-e7f0362596fc","name":"Dockerfile","targetId":"ae992fb3-d252-417c-b8fd-c36e1ca862eb"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"ae992fb3-d252-417c-b8fd-c36e1ca862eb"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"ae992fb3-d252-417c-b8fd-c36e1ca862eb"}],"recentChangeFlags":null},{"id":"048fb8ac-794e-4446-b0ee-2bf014f609f7","uri":"https://github.com/hemilabs/op-geth","name":"https://github.com/hemilabs/op-geth","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"90dc0118-dcc6-4e9d-9172-05559cccd760","sortOrder":3},"sortOrder":3,"tags":[{"id":"80ac7b70-7adf-4684-ab9b-e7f0362596fc","name":"Dockerfile","targetId":"048fb8ac-794e-4446-b0ee-2bf014f609f7"},{"id":"8442481b-5110-4077-bdd1-54fd464584f6","name":"Go","targetId":"048fb8ac-794e-4446-b0ee-2bf014f609f7"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"048fb8ac-794e-4446-b0ee-2bf014f609f7"}],"recentChangeFlags":null},{"id":"1ff0cedd-c726-4ff5-aae7-6db252e5df0d","uri":"https://github.com/hemilabs","name":"All unarchived non-fork repositories under https://github.com/hemilabs","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1f7c84a9-743b-4d93-bf43-a385171b3802","sortOrder":4},"sortOrder":4,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"1ff0cedd-c726-4ff5-aae7-6db252e5df0d"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eHemi values open source. As a blockchain network, the majority of our code is open source and open for anyone to inspect or contribute to.\u003c/p\u003e\n\n\u003cp\u003eThis scope includes all public repositories under the \u003ca href=\"https://github.com/hemilabs\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHemi Labs GitHub organisation\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArchived and forked repositories are out-of-scope unless explicitly marked as in-scope.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch3\u003eExclusions\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003ehemilabs/fpmm\u003c/code\u003e repository is out-of-scope. This repository contains a development prototype, and is not used in production.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"b2b4a996-872b-48d4-bec3-d78a7bfe684b","name":"Hemi Services/Infrastructure","targets":[{"id":"505ee50f-3449-4baf-ab3a-5983b73193c5","uri":"","name":"*.hemi.xyz","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e8fe591d-359e-4265-b558-bcf25e3a0765","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"505ee50f-3449-4baf-ab3a-5983b73193c5"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"505ee50f-3449-4baf-ab3a-5983b73193c5"}],"recentChangeFlags":null},{"id":"d3fa54bb-8d7d-44e8-9b0f-d48821ebd928","uri":"","name":"*.hemi.network","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"bfeb84d3-19aa-4059-bba7-630ce1482bf2","sortOrder":1},"sortOrder":1,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"d3fa54bb-8d7d-44e8-9b0f-d48821ebd928"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"d3fa54bb-8d7d-44e8-9b0f-d48821ebd928"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThis scope encompasses all web assets and services hosted under the \u003ccode\u003e*.hemi.xyz\u003c/code\u003e and \u003ccode\u003e*.hemi.network\u003c/code\u003e domains, as well as any other targets verified as operated by Hemi.\u003c/p\u003e\n\n\u003cp\u003eIf you have found an issue, and it doesn\u0026#39;t relate to any other target group, please submit it here.\u003c/p\u003e\n\n\u003cp\u003eIssues in third-party service providers will be assessed according to the \u0026quot;Third Party Providers\u0026quot; target group, unless a security issue due to Hemi\u0026#39;s misconfiguration can be demonstrated.\u003c/p\u003e\n\n\u003ch3\u003ehemi.xyz\u003c/h3\u003e\n\n\u003cp\u003eThis is our domain for public-facing websites.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe following subdomains are used for third-party services, which will be assessed according to the \u0026quot;Third Party Providers\u0026quot; target group.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003enews.hemi.xyz\u003c/code\u003e (hosted by \u003ca href=\"https://ghost.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGhost\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edocs.hemi.xyz\u003c/code\u003e (hosted by \u003ca href=\"https://gitbook.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eGitBook\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003ehemi.network\u003c/h3\u003e\n\n\u003cp\u003eThis is our domain for public-facing APIs and RPC endpoints.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"64891234-4fb8-4f83-ad35-a64aca6ff174","name":"Vetro","targets":[{"id":"ccd12a3b-4d0b-4b0a-9dfe-205b4e086a03","uri":"https://vetro.org","name":"vetro.org","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"35ef15ec-13cb-43c6-a481-9f056a2ee368","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ccd12a3b-4d0b-4b0a-9dfe-205b4e086a03"}],"recentChangeFlags":null},{"id":"014ebc79-5531-4ee6-991a-530be05b3bd2","uri":"https://app.vetro.org","name":"app.vetro.org","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"26711949-5880-4df4-ac34-236af933da8d","sortOrder":1},"sortOrder":1,"tags":[{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"014ebc79-5531-4ee6-991a-530be05b3bd2"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"014ebc79-5531-4ee6-991a-530be05b3bd2"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"014ebc79-5531-4ee6-991a-530be05b3bd2"},{"id":"d8e93657-68c0-4b47-ae77-d3c15602dd5b","name":"Cryptocurrency","targetId":"014ebc79-5531-4ee6-991a-530be05b3bd2"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"014ebc79-5531-4ee6-991a-530be05b3bd2"}],"recentChangeFlags":null},{"id":"08837c74-39d9-4d01-bc51-925580d94195","uri":"https://api.vetro.org","name":"api.vetro.org","category":"api","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"da438a25-781f-4be8-8312-ff169c9d958a","sortOrder":2},"sortOrder":2,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"08837c74-39d9-4d01-bc51-925580d94195"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"08837c74-39d9-4d01-bc51-925580d94195"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"08837c74-39d9-4d01-bc51-925580d94195"}],"recentChangeFlags":null},{"id":"eca7f956-b407-4ef4-846c-73d2bcef4826","uri":"https://*.vetro.org","name":"*.vetro.org","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f12c5157-bdb6-4ec0-b58a-7acb04074635","sortOrder":3},"sortOrder":3,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"eca7f956-b407-4ef4-846c-73d2bcef4826"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"eca7f956-b407-4ef4-846c-73d2bcef4826"}],"recentChangeFlags":null},{"id":"d0e95f43-91bd-4769-a174-e586a98352eb","uri":"https://github.com/vetro-protocol","name":"All unarchived non-fork repositories under https://github.com/vetro-protocol","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b89fc840-4a97-4add-9a55-ca080d165ef7","sortOrder":4},"sortOrder":4,"tags":[{"id":"20f6988d-5b8c-41bb-9ca8-d9b271b7874d","name":"Github","targetId":"d0e95f43-91bd-4769-a174-e586a98352eb"},{"id":"33a7c027-8a7e-4564-8330-cb149ab4352e","name":"TypeScript","targetId":"d0e95f43-91bd-4769-a174-e586a98352eb"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"d0e95f43-91bd-4769-a174-e586a98352eb"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":6,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eVetro is a project by Hemi Labs.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://vetro.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003evetro.org\u003c/code\u003e\u003c/a\u003e is the Vetro marketing website.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://beta.vetro.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003eapp.vetro.org\u003c/code\u003e\u003c/a\u003e is the Vetro web app.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://api.vetro.org\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003e\u003ccode\u003eapi.vetro.org\u003c/code\u003e\u003c/a\u003e is the API powering the Vetro app.\u003c/li\u003e\n\u003cli\u003eAll unarchived non-fork repositories under the \u003ca href=\"https://github.com/vetro-protocol\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003evetro-protocol\u003c/a\u003e GitHub organisation. \n\u003cstrong\u003eArchived and forked repositories are out-of-scope unless explicitly marked as in-scope.\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"f4caf965-601a-491b-ab1a-3c58518d14c9","name":"Third Party Providers","targets":[{"id":"416d5940-5e29-48f7-a41d-9a5e0f3ae93e","uri":"","name":"Third Party Provider Vulnerability","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9120a537-2d6e-4428-bfff-4c33144e673b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":7,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eHemi uses a large number of third-party providers such as Google Cloud Platform, Cloudflare, Slack, etc.\u003c/p\u003e\n\n\u003cp\u003eResearches should ensure they have the provider\u0026#39;s permission to:\u003c/p\u003e\n\n\u003col\u003e\n\u003cli\u003ePerform security testing (e.g., through the provider\u0026#39;s VDP or bug bounty program)\u003c/li\u003e\n\u003cli\u003eUse their platform to build a proof-of-concept.\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cp\u003eWe will assess vulnerabilities in third-party providers on a case-by-case basis, considering impact of the vulnerability, the role of the provider, what data is stored within the provider, and the realistic outcomes of such a vulnerability.\u003c/p\u003e\n\n\u003cp\u003eSecurity issues related to our misconfiguration or misuse of a third-party service will be considered.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"30af315a-1842-40d4-8567-77ccdd8716c5","name":"Out of Scope","targets":[{"id":"71d8fb69-f4f8-49cd-a42e-4177be5e0613","uri":"","name":"Any Atlassian Product/Service","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"94bb3ff0-2da5-47d2-b49b-d2abe601da5f","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null}],"inScope":false,"sortOrder":8,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eExplicitly out-of-scope targets.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eHemi Labs does not use Atlassian products or services. Any Atlassian services discovered are not owned by Hemi Labs.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"34f1a0dc-5d79-40f7-989a-f0b047b5f4b7","code":"hemi","state":"in_progress","endsAt":null,"bountyId":"5d32b056-7ed4-424a-822b-e42ea5a2c891","startsAt":"2025-11-11T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/1064/02da/d446b33c/094a416bc14088f6eba2008d80f1b871_hemi-symbol-orange.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-11-11T18:00:00.039Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/hemi","changelogs":"/engagements/hemi/changelog","submissions":null,"announcements":"/engagements/hemi/announcements","hallOfFame":"/engagements/hemi/hall_of_fames","crowdstream":"/engagements/hemi/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/hemi/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=hemi\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/hemi/engagement_subscribers","engagementChangelogsUrl":"/engagements/hemi/changelog","publishedAt":"2026-09-02T16:37:30.957Z","engagementChangelogUrl":"/engagements/hemi/changelog/cbdae4b1-7182-44d4-98ad-c839a8e61c80","createUserFeedbacksUrl":"/engagements/hemi/feedbacks","engagementCrowdstreamUrl":"/engagements/hemi/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}