Vulnerability Disclosure Policy
Last updated: 21 October 2026
In Scope
- https://tradepilot.work
- https://app.tradepilot.work, including the customer portal
- https://api.tradepilot.work
- the TradePilot iOS and Android apps
Out of Scope
- services run by our providers (for example Cloudflare, Hetzner, Stripe, GoCardless, Google or Apple) — please report to them directly;
- denial-of-service or load testing;
- social engineering or phishing of our staff or customers;
- physical attacks;
- spam or rate-limit reports without a security impact;
- missing best-practice headers or settings without a demonstrated risk.
How to Report
Email [email protected] with “Security” in the subject line and:
- what you found and where (URL, endpoint or app screen);
- steps to reproduce;
- the impact you think it has;
- your contact details, if you would like us to reply.
Please write in English.
Please Do
- use only test accounts you create yourself;
- stop testing and tell us as soon as you find a vulnerability;
- access, keep and share as little data as possible — if you see personal data, stop, do not copy it, and tell us;
- give us reasonable time to fix the issue before telling anyone else.
Please Do Not
- access, change or delete data belonging to other users or businesses;
- move from one system or account to another after finding a vulnerability;
- run automated scans that degrade the service;
- demand payment in return for a report.
What You Can Expect From Us
- a reply within 5 working days;
- an initial assessment within 10 working days;
- updates while we work on a fix;
- public credit for your report once the issue is fixed, if you would like it and only with your permission.
We do not currently run a paid bug bounty.
Legal
If you make a good-faith effort to follow this policy, we will treat your research as authorised, we will not take legal action against you or ask law enforcement to investigate you for it, and we will work with you to understand and fix the issue. If someone else takes legal action against you for research that followed this policy, we will make it known that your research was authorised. This commitment covers TradePilot only: it cannot give you permission to test our providers' systems, and it does not override the law.
If a report shows that personal data may have been exposed, we will handle it under our personal data breach procedure.