Security policy

We take security reports seriously and want to hear about any weakness you find in ACCE Investments. This page explains how to reach us and what to expect.

Reporting a vulnerability

Email us with the subject line "Security report" at [email protected]

Please include:

• The affected URL, endpoint or feature
• Step-by-step instructions to reproduce the issue
• The impact you observed: what an attacker could read, change or do
• Any proof-of-concept requests or screenshots

We aim to acknowledge reports within 5 business days and will keep you updated until the issue is resolved.

Bug bounty

ACCE Investments does not run a paid bug bounty program. We do not pay for reports, and we will not discuss payment before a finding has been disclosed and verified. With your permission, we are happy to credit valid reports publicly.

Rules for testing

• Only test against your own account. Do not access, modify or delete other users' data.
• Do not run denial-of-service, load or spam tests, or automated scans that degrade the service.
• Do not use social engineering or phishing against our staff or users.
• Give us a reasonable amount of time to fix an issue before disclosing it publicly.

Out of scope

The following are generally not treated as vulnerabilities unless you can show real impact:

• The Supabase anon key or Stripe publishable key appearing in client code. Both are public by design; data access is enforced server-side.
• Missing security headers or cookie flags without a working exploit
• SPF, DKIM or DMARC configuration
• Clickjacking on pages with no sensitive actions
• Software version disclosure
• Rate limiting on non-sensitive endpoints
• Reports from automated scanners without a verified, reproducible issue

Machine-readable contact details: /.well-known/security.txt