Protect your account and wallet

The primary website is https://rebelieve.app. Check the full domain before connecting a wallet or entering account information. Service availability is published at status.rebelieve.app.

• Confirm the active wallet and network match the action you intended.
• Review the assets, amount, destination, expected output, fees, and price impact.
• Reject unexpected signature or transaction requests and return to the official site.
• Use an up-to-date browser, wallet application, and operating system.

Transaction requests may be prepared or routed through independent providers. Your wallet provides the final review and approval step.

Never send a recovery phrase, private key, password, or one-time code through email, Telegram, Discord, social media, or support chat. reBelieve support will not ask you to disclose them.

Only enter recovery material inside the explicit wallet import or recovery flow you chose on the official reBelieve interface. External wallets such as Phantom handle their own signing and recovery.

Send suspected vulnerabilities to support@rebelieve.app with the subject “Security report”. Include:

• The affected URL or feature and a concise description of the issue.
• Steps to reproduce it and the impact you believe is possible.
• Relevant screenshots, public transaction links, or non-sensitive logs.
• A safe way to contact you for follow-up.

Do not access data that is not yours, move user funds, disrupt service, publish sensitive details before remediation, or include secrets in a report. We will review reports and prioritize confirmed issues based on their impact. No reward is promised unless a separate written bounty program says otherwise.

Security tools can use the RFC 9116 file at https://rebelieve.app/.well-known/security.txt. A compatibility copy is also available at https://rebelieve.app/security.txt.