Vulnerability Disclosure Policy

1. How to Report

Email info@acubic.ai with the subject line "Security report". Please include:

• the affected URL or feature;
• the steps to reproduce the issue;
• what an attacker could do with it;
• the test account you used, if any.

Please do not share the issue publicly until we have fixed it or agreed a date with you. The same contact is published in our security.txt file.

2. Scope

In scope:

• acubic.ai
• mcp.acubic.ai

Out of scope: the brokers you connect (such as eToro and Trading 212), our payment and email providers, and any other third-party service. Report issues in those services to their owners.

3. Rules for Testing

The following are not allowed:

• automated scanners and any high-volume testing;
• denial of service, or anything that slows the service down for others;
• email or SMS flooding, including repeated sign-up or password-reset requests;
• social engineering or phishing of our staff or users;
• testing against other users' accounts or data;
• physical attacks against our offices, staff or hosting.

Use only test accounts that you created yourself. If you reach another person's data by accident, stop at once, do not keep or share it, and tell us what you accessed.

4. Our Commitment

We will acknowledge your report within 5 business days. We will tell you whether we can reproduce the issue and keep you informed of the fix status until it is resolved.

5. Safe Harbour

If you research in good faith and follow the rules on this page, we will consider your research authorised. We will not take legal action against you or ask others to do so for that research. If a third party takes action against you for research that followed these rules, we will make it known that your work was authorised. This does not cover testing that breaks the rules above.

6. Rewards and Credit

We do not run a bug bounty programme and do not pay for reports. If you would like, we will credit you by name once the issue is fixed.

See also our Terms and Conditions and Privacy Policy.