Security and Responsible Disclosure

How to report

• Email support@metatraderapi.net with the subject "Security". Our machine-readable contact is at https://www.metatraderapi.net/.well-known/security.txt.
• Describe the issue, the affected host or endpoint, the steps to reproduce, and the impact you expect.
• Please do not include real customer data in the report; a minimal proof is enough.

What we promise

• We confirm receipt within 2 business days and give you a first assessment within 7 days.
• We keep you informed while we fix it and tell you when it is fixed.
• We will not take legal action against you for research that follows this policy, and we will not ask your employer or anyone else to.
• With your permission we credit you in the hall of fame below.

In scope

• www.metatraderapi.net (website), app.metatraderapi.net (dashboard), api.metatraderapi.net and api.metatraderapi.net (API) and status.metatraderapi.net (status page).

Please do not

• Access, change or delete data that is not yours, or connect to MetaTrader accounts you do not own.
• Run denial-of-service tests, high-volume automated scans or spam, or test from accounts with live trading capital.
• Use social engineering or physical attacks against us, our customers or our providers.
• Publish details before we have fixed the issue, or 90 days after your report, whichever comes first, unless we agree otherwise.

Out of scope

• Reports from automated scanners without a demonstrated impact.
• Missing best-practice headers or TLS settings that have no practical exploit.
• Vulnerabilities in your broker, in MetaQuotes software, or in third-party services we do not operate.

Rewards

We are a small company and do not run a paid bug bounty. We thank researchers publicly and, for significant findings, with free seats.

Hall of fame

No reports yet. Be the first.