Security and Responsible Disclosure
We welcome reports from security researchers and customers. If you believe you have found a vulnerability in API2Trade, please tell us privately first so we can fix it before it is used against our customers.
How to report
- Email support@api2trade.com with the subject "Security".
- Describe the issue, the affected host or endpoint, the steps to reproduce, and the impact you expect.
- Please do not include real customer data in the report; a minimal proof is enough.
What we promise
- We confirm receipt within 2 business days and give you a first assessment within 7 days.
- We keep you informed while we fix it and tell you when it is fixed.
- We will not take legal action against you for research that follows this policy, and we will not ask your employer or anyone else to.
- With your permission we credit you in the hall of fame below.
In scope
- www.api2trade.com (website), app.api2trade.com (dashboard), api.api2trade.com (API) and status.api2trade.com (status page).
Please do not
- Access, change or delete data that is not yours, or connect to MetaTrader accounts you do not own.
- Run denial-of-service tests, high-volume automated scans or spam, or test from accounts with live trading capital.
- Use social engineering or physical attacks against us, our customers or our providers.
- Publish details before we have fixed the issue or before 90 days have passed since your report, whichever comes first, unless we agree otherwise.
Out of scope
- Reports from automated scanners without a demonstrated impact.
- Missing best-practice headers or TLS settings that have no practical exploit.
- Vulnerabilities in your broker, in MetaQuotes software, or in third-party services we do not operate.
Rewards
We are a small company and do not run a paid bug bounty. We thank researchers publicly and, for significant findings, with a reward at our discretion.
Hall of fame
No reports yet. Be the first.