Responsible disclosure
Effective · Version 0.9
Draft for legal review. This document is not yet final and may change before launch.
In short Found a vulnerability? Tell us privately, give us time to fix it, and we won't pursue good-faith research. (This summary is not legally binding.)
How to report
Email security@bankqore.com with the details and steps to reproduce. See /.well-known/security.txt.
What we ask
- Don't access, change or delete data that isn't yours
- Don't degrade the service (no denial-of-service testing)
- Give us reasonable time to fix before you publish
What we promise
- A reply within two business days
- Updates until the issue is fixed
- No legal action for good-faith research within these rules