Report a vulnerability

Last updated: November 8, 2026

If you find a security problem in Wyro, we want to hear about it. This page explains what to report, how to send it, and what we ask of you while you look.

What's in scope

• The Wyro mobile app for Android and iOS.
• The Wyro web app (private beta) and the websites wyro.app and wyrolabs.org, including their subdomains.
• Wyro's own APIs that these apps call.

What's out of scope

Wyro is self-custodial and connects to protocols it doesn't run. Report problems in these to the teams that build them:

• Avalanche and its networks, Hyperliquid, Aave, Benqi, Tenderly, Ledger devices and firmware, and third-party wallets.
• Bugs that need a jailbroken or rooted phone, physical access to an unlocked device, or a compromised operating system.
• Reports that only list missing headers or best practices without a way to cause harm.

How to report

Email contact@wyrolabs.org with "Security" in the subject. Include:

• What the problem is and what someone could do with it.
• The steps to reproduce it, with the app version, platform, and the address or URL involved.
• Any proof of concept, screenshots, or logs that help us see it.

We read every report and reply from the same address. Please write in English.

While you look

• Use your own wallets and accounts. Don't access, move, or change anyone else's funds or data.
• Don't run tests that degrade the service for others, such as denial of service or high-volume automated scanning.
• Don't use social engineering, phishing, or physical attacks against our team or users.
• Give us reasonable time to fix the problem before you share details publicly.

Wyro will never ask for your recovery phrase, private key, or PIN, and neither should anyone claiming to be us.