How to tell us about a security problem, and what happens when you do.
Write to security@tradekraft.rocks. Tell us what you found, where, and what you had to do to find it. A rough note that arrives is worth more than a polished one that does not.
The same address is published at /.well-known/security.txt.
Acknowledge you within three working days. Tell you what we think it is and whether we agree it is a problem. Tell you when it is fixed.
Credit you by name when it is fixed, if you want that. Say nothing about you at all, if you would rather.
Give us a reasonable chance to fix it before you tell anyone else. Do not access, change or keep anyone else's data: if you can prove it with one record that is yours, stop there.
Do not degrade the service for other people. No denial of service, no spam, no social engineering of our members or our staff.
We will not pursue you, and we will not ask anyone else to. Research done in good faith under the terms above is authorised, and we will say so in writing if you need it.
There is no bounty programme yet. We would rather tell you that plainly than imply one exists.
The platform is behind authentication with row-level access rules, so what a request can read is decided by the database rather than by the page asking. Mail we send is signed. The site itself is static and loads nothing from third parties.
None of that is a claim of being secure. It is what we have built so far, said plainly enough that you can tell us where it is wrong.