Security

Reporting a vulnerability

How to tell us about a security problem in Levy, what is in scope, and what we commit to in return.

How to report

Email hello@getlevy.xyz with "Security" in the subject. Please include:

• what is affected: a contract address, a URL or a component;
• the steps to reproduce it, or a proof of concept;
• the impact you see, and anything you already know about a fix.

Please keep it private until it is fixed or we have agreed a date to publish together. This address is also listed in our security.txt.

Scope

• The Levy contracts on Arc testnet: SubscriptionManager 0x33c8e7e46583bdfd2e001f55ac1c58bd84eb739f and FeeRouter 0xa6efee5f5a2eb2afae102f790b4889fcc01fe848, and the mainnet contracts once they are deployed.
• The app at app.getlevy.xyz: the API, merchant dashboard, customer portal and checkout.
• The keeper: charging, dunning, and the signing and delivery of webhooks.
• This website, getlevy.xyz.

Out of scope: Arc itself, USDC, Permit2 and wallets (please report those to their owners), denial of service and load testing, social engineering, and scanner output or missing headers without a demonstrated impact.

Rules for testing

• Test on Arc testnet with your own wallets, plans and subscriptions. Do not touch anyone else's subscriptions, wallets or webhook endpoints.
• Keep automated requests slow; the API is rate-limited, and flooding it helps nobody.
• Stop once you can show the impact, and do not keep or share data that is not yours.

What we commit to

• We acknowledge every report within 3 business days and keep you updated until it is resolved.
• We fix confirmed issues before mainnet, and credit you in our security review if you would like that.
• We will not pursue or support legal action against research that follows this policy in good faith.

Levy does not run a paid bug bounty yet.

Levy © 2026 · hello@getlevy.xyz