Responsible disclosure

Report a potential security vulnerability.

Help us review potential security issues through an approved and confidential reporting process.

Policy status
Approved
Authorized scope
As stated below
Reporting channel
As stated below
PGP availability
Must be confirmed
Bug bounty
Not stated

FinTrace Intelligence takes security seriously and values the security research community's efforts in helping us maintain a secure platform. This policy outlines how to report vulnerabilities to us safely and how we will handle such reports.

Reporting route

security@fintraceintelligence.com

Start secure report

Do not include passwords, private keys, customer records, personal data, or unnecessary sensitive information. Do not attach executable files.

Scope of authorized testing

In scope

  • Public-facing websites: fintraceintelligence.com and documented subdomainsAuthorized for testing
  • API endpoints accessible without authenticationAuthorized for testing
  • Mobile applications published by FinTrace IntelligenceAuthorized for testing
  • Documentation and support portalsAuthorized for testing

Out of scope

Explicitly out of scope

  • Customer production environments and dataOut of scope
  • Third-party services not operated by FinTrace IntelligenceOut of scope
  • Physical security testing or social engineeringOut of scope
  • Infrastructure not owned by FinTrace IntelligenceOut of scope
  • Denial of service attacks or resource exhaustionOut of scope
  • Automated scanning tools that generate excessive trafficOut of scope

Testing conditions

  • Follow applicable law
  • Test only explicitly authorized assets
  • Avoid accessing, modifying, or deleting third-party data
  • Avoid service disruption
  • Use the minimum testing necessary
  • Stop if sensitive information is encountered
  • Preserve confidentiality
  • Report the issue through the approved channel

Conditions as currently written

  • Testing must not violate applicable laws
  • Do not access, modify, or delete data belonging to others
  • Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
  • Maintain confidentiality of discovered vulnerabilities until authorized disclosure

Reporting channel

Encrypted reporting
Encrypted reporting channel pending confirmation

What to include in a report

  • Clear vulnerability description
  • Affected verified asset
  • Potential impact
  • Safe reproduction steps
  • Relevant request or response details
  • Sanitized screenshots or proof of concept
  • Severity assessment
  • Researcher contact information
  • Preferred communication method

Do not include passwords, private keys, customer records, personal data, or unnecessary sensitive information.

Handling and coordination

  1. Report receivedWe will acknowledge receipt of your report within 72 hours.
  2. Receipt reviewed
  3. Scope confirmed
  4. Issue assessedOur security team will triage and validate reported vulnerabilities. We may request additional information to fully understand the scope and impact.
  5. Remediation coordinatedConfirmed vulnerabilities will be prioritized based on severity and impact. We aim to remediate critical vulnerabilities within 30 days and high-severity issues within 60 days.
  6. Reporter updatedWe will keep you informed of our progress and notify you when the vulnerability is resolved.
  7. Disclosure discussedWe request that you maintain confidentiality until we have deployed a fix. Once resolved, we welcome responsible disclosure and will acknowledge your contribution in our security advisories if desired.

Disclosure coordination and safe harbor

Disclosure coordination

We request that you maintain confidentiality until we have deployed a fix. Once resolved, we welcome responsible disclosure and will acknowledge your contribution in our security advisories if desired.

Safe harbor

FinTrace Intelligence will not pursue legal action against security researchers who comply with this policy and act in good faith.

What researchers can expect

  • Receipt confirmation when operationally possible
  • Scope review
  • Good-faith communication
  • Status updates according to the approved process

What FinTrace expects

  • Testing within approved scope
  • Minimal impact
  • Confidentiality
  • Responsible communication
  • No customer-data access or disruption

Contact

Questions about this policy: security@fintraceintelligence.com