Security & Vulnerability Disclosure

Last updated: July 19, 2026

Cupcake is developed by Cake Labs LLC. It turns an old phone into an air-gapped, offline signing device, so we take the security of the app seriously and welcome reports from security researchers. If you believe you have found a vulnerability, please report it privately through one of the channels below.

How to report a vulnerability

Please do not open a public GitHub issue or post publicly about a security vulnerability. Public disclosure before a fix is available puts users' funds and privacy at risk. Instead, use one of these private channels:

1. GitHub private security advisory (preferred): Report a vulnerability to cake-tech/cupcake. This opens a private, structured thread with the maintainers.
2. Encrypted email: security@cakewallet.com. For sensitive reports, encrypt with our PGP key (fingerprint DC91 6520 0271 AC6A 0533 3D3C BFE7 D9A5 0E4D 3A0A).

Both channels are actively monitored and automatically alert our internal security team, so reports will not be missed. Please include a clear description of the issue and its security impact, steps to reproduce (ideally a proof of concept), the affected platform and app version, and any relevant details about the signing or QR flow.

Our commitment (safe harbor)

We consider good-faith security research conducted under this policy to be authorized, and we will not pursue legal action against researchers who avoid privacy violations and service disruption, only access accounts or devices they own or are permitted to test, and give us a reasonable opportunity to fix an issue before disclosing it publicly.

What to expect

• Acknowledgement within 2 business days.
• Triage within 7 business days.
• Coordinated disclosure: we aim to ship a fix and agree a public disclosure date with you within 90 days.
• Credit: with your permission, we are glad to publicly credit you once a fix is released.

Scope

In scope: the Cupcake application and the code in the cake-tech/cupcake repository — anything that could lead to loss of funds, exposure of keys or seeds, a privacy leak, or an incorrect signature. Out of scope: third-party services and wallets we do not operate; automated-scanner output without demonstrated impact; low-severity or informational issues on our marketing and landing websites (for example reflected or self-XSS, missing security headers, clickjacking on pages with no sensitive actions, or SPF/DMARC and cookie-flag nitpicks) that do not affect the app or user funds; and social-engineering or physical attacks.

Rewards

At our sole discretion, we may offer a reward for a valid report. To be eligible, a report must be submitted privately through one of the channels above (a GitHub private security advisory or security@cakewallet.com) — anything disclosed publicly or sent through other channels is not eligible — and must identify a genuine vulnerability with real impact on users, typically loss of funds, exposure of keys or seeds, a privacy leak, or an incorrect signature.

Trivial or low-impact findings are not eligible — for example, reflected XSS or other low-severity issues on our marketing websites, missing security headers, hardening or best-practice suggestions, automated-scanner output without a working proof of concept, or already-known issues. There is no fixed bounty and no guaranteed payout; whether a report qualifies, and any amount, are determined solely by Cake Labs LLC.

Supported versions

We do not maintain previous releases. Only the latest release for each platform is supported; security fixes are delivered in new versions. Please keep Cupcake up to date.