Reporting a security issue
Finmind handles real brokerage connections and personal financial data. If you have found something that puts either at risk, we want to hear about it, and we would rather hear early than politely.
How to reach us
Use the contact form on the home page and begin your message with SECURITY so it is routed ahead of general enquiries.
Or email the mailbox the team reads for every problem and report:
finmind_support@protonmail.comWe are candid about why the mailbox is not on our own domain: finmind.uz has no inbound mail yet, so a published address there would bounce your report. When that changes this page will name it, and /.well-known/security.txt will be updated with it.
In scope
- finmind.uz and its subdomains
- The Finmind web application and its API under /api/v1/
- Authentication, session handling and access control
- Anything exposing another user's data, positions or documents
Out of scope
- Denial-of-service and volumetric testing, which we ask you not to run
- Automated scanner output with no demonstrated impact
- Findings that require access to a victim's own device or mailbox
- Missing hardening headers with no exploitable consequence
What to expect
We aim to acknowledge a report within three working days and to tell you what we found and what we changed. We do not run a paid bug-bounty programme, and we would rather say so plainly than imply a reward that does not exist. Credit is offered gladly to anyone who wants it.
Please give us a reasonable chance to fix an issue before disclosing it, and please do not access, modify or retain another person's data while testing. A proof of concept against your own Finmind account is enough.
Machine-readable version: /.well-known/security.txt