Security
If you find a way to break the engine, the apps or the streams, we want to hear it first.
Reporting
Email [email protected] with what you found, how to reproduce it and what it lets you do. We acknowledge within one business day, keep you informed while we fix it, and credit you here if you want. Rewards are at our discretion during the public test; a published bounty programme comes with real-money trading.
In scope
- The trading app, the gateway API and the two WebSocket streams.
- Order handling, margin, liquidation, settlement and anything that changes a balance.
- Sign-in, sessions, the stream token and account separation.
- This website, the waitlist and the blog.
Out of scope
- The perp venue and its market data: report those to the venue.
- Denial of service, rate-limit probing and automated scanning that degrades the service for others.
- Social engineering, phishing and physical attacks.
- Reports from automated tools without a demonstrated impact.
Rules
- Test only against your own accounts. Every balance is mock USDC; there is nothing to steal, so please do not try to drain anyone else's.
- Do not access, modify or keep other users' data.
- Give us a reasonable time to fix a finding before talking about it publicly. Ninety days is the default.
How the system is built
Nothing is reachable from the internet except through one front door; sign-in state lives on the server, not in the browser; every order is recorded before it is acknowledged and the record is verified on every start; risk limits and halts are enforced where orders are matched, not in the interface; and backups leave the server continuously.