Legal documents · Security
Security
How to report a vulnerability in our systems.
Contact
Report security issues to info@money.financial. We aim to acknowledge reports within five working days.
Scope
This policy applies to money.financial and its subdomains. It does not cover third-party services or links we do not operate.
What to report
Report anything you believe could compromise the confidentiality, integrity or availability of user data or our service. This includes exposed credentials, injection vulnerabilities, data leakage and authentication issues.
What we ask
Do not exploit a vulnerability you have found. Do not share findings beyond our team without written agreement. Provide enough detail to reproduce the issue.
Response commitment
We aim to acknowledge reports within five working days. We cannot commit to a fixed resolution timeline. We will keep you informed of progress where appropriate.
Encryption
You can encrypt sensitive reports using the PGP key at /.well-known/security-key.asc (fingerprint: 84E058DB397F5510929CC927FD996DC947E61B59).