How Do I Report a Bug or a Security Issue?
Report it through support chat. Open support inside the Peanut app, or use the chat button at the bottom of this page, and describe what happened. If you found a security vulnerability, start your message with the word security so it reaches our engineers instead of the normal support queue. This page covers what to include, what we consider in scope, and what happens after you send it.
Reporting a Bug
Anything that looks broken is worth telling us about: a screen that will not load, a payment that did not arrive, a balance or a rate that looks wrong, a button that does nothing. You do not need to know why it happened or whether it is "really" a bug. If it looked wrong to you, send it.
The reports we can act on fastest are the ones we can reproduce.
Send a Bug Report
- 1
Open support chat
In the app, open support from your profile. On this page, use the chat button below.
- 2
Say what you were trying to do
One line is enough. "I was paying a QR code in Buenos Aires."
- 3
Say what happened instead
Include the exact error message if you saw one, word for word.
- 4
Add a screenshot or a screen recording
A recording of the moment it breaks is the single most useful thing you can send.
- 5
Tell us your device
Phone model and browser, plus roughly what time it happened, so we can find it in our logs.
Reporting a Security Vulnerability
If you believe you have found a security flaw, use the same support chat and put security at the start of your message. Describe the issue, the steps to reproduce it, and what someone could actually do with it. That last part matters most to us: a clear description of the impact is what turns a finding into a fix.
Please tell us before you tell anyone else, and give us a chance to ship a fix.
What Is in Scope
- The Peanut app and website at peanut.me
- The Peanut API
- The smart contracts behind Peanut accounts
What Is Out of Scope
- Our partners' systems. Identity verification, banking, and card issuing are operated by third parties. Report issues in those systems to them directly.
- Scanner output with no demonstrated impact. Tell us what an attacker could do, not what a tool flagged.
- Denial of service, spam, and volumetric testing. Do not run these against us.
- Social engineering of our team, our partners, or our users.
- Anything requiring physical access to another person's unlocked device or their fingerprint or face.
Important
What Happens After You Report
We read every report. Straightforward bugs are usually answered in the support chat. Security reports go to our engineering team, which takes longer, and we may not be able to share details while a fix is in progress.
Rewards are discretionary. We do sometimes reward reports, weighing how serious the issue is and whether it is something we did not already know about. There is no fixed payout schedule, no tiers, and no guaranteed amount. Report it because you want it fixed.
Since Peanut started we have paid out more than $20,000 for bug reports, including several larger bounties settled directly with the reporter. That is a description of what we have done, not a price list for what any one report will earn.
Why We Want to Hear From You
Peanut holds people's money. Most of the balances on it are rent, groceries, a payment to family, or a contractor waiting to be paid. A bug that strands $40 is not a small bug to the person it happened to, and neither is a screen that quietly does the wrong thing. We would rather hear it from you now than find it in a support thread three weeks later.
That applies to more than security holes. If something about the app is confusing, slow, or just feels wrong, the same chat is the right place for it.
Info
If a Bug Cost You Money
Say so explicitly in your first message, and include the amount and roughly when it happened. Support can check where it ended up, and money that is stuck rather than gone can often be recovered. Peanut cannot reverse a completed transaction, so the sooner you tell us, the more we can do. See refunds for how this works.
FAQ
Do you pay for bug reports?+
Sometimes, at our discretion. We weigh how serious the issue is and whether it is new to us. There is no fixed amount, no severity tiers, and no guarantee, so please do not report something expecting a specific figure.
Has Peanut ever actually paid out?+
Yes. More than $20,000 across bug reports since Peanut started, including several larger bounties settled directly with the reporter rather than through the app. We treat that as history rather than a rate card, which is why the reward for any single report is decided case by case.
I saw a page saying Peanut pays up to $10,000 per bug. Is that still true?+
No. That was an older program and it is retired. Some out-of-date copies of it are still floating around on the internet. Rewards today are discretionary and are decided case by case.
How long until I hear back?+
We do not promise a response time. Bug reports are handled in the support chat alongside everything else coming in, and security reports go to engineering, which generally takes longer.
Can I report anonymously?+
Yes. Open support chat without signing in and send the report. We will not be able to follow up with questions or reward you, so a contactable report is more useful to both of us.
Should I post it publicly or in Discord instead?+
For an ordinary bug, either is fine and we will see it. For a security issue, tell us privately first and give us time to fix it before you publish.
I found the problem in a partner's system, not in Peanut. What do I do?+
Report it to that company directly, since we cannot fix or reward something in a system we do not run. If you are not sure which side the problem is on, send it to us and we will tell you.
Is my money at risk while a bug is open?+
Your funds sit in your own account and only your fingerprint or face can move them, so a bug in the app does not hand anyone else control of your balance. See security and fund safety for how that works.