Vulnerability disclosure policy

Write to us at contacto@stockai.es with the subject "Vulnerability: short summary". Include, if you can:

• what you found and at which address or endpoint;
• the steps to reproduce it, and a proof of concept if you have one;
• what impact you think it has;
• how you would like to be credited, if at all.

We also publish these details at stockai.es/.well-known/security.txt, following the RFC 9116 standard. We do not have a PGP key today; if the report contains sensitive data, let us know and we will agree how to send it.

• stockai.es (the public website);
• app.stockai.es (the application);
• the API and the MCP server served from app.stockai.es.

Use your own accounts: you can sign up or use a trial account. If you need two accounts to test the isolation between companies, create two of your own.

• denial-of-service attacks or load testing;
• social engineering of our team or our customers, and phishing;
• physical attacks on offices or equipment;
• our providers' services (Hostinger, DeepSeek, Resend, Twilio): report those to them;
• automated scanner reports without a demonstrated exploit, and missing best practices with no real impact (for example, an absent header that cannot be exploited).

• Do not access, change or delete data that is not yours. If you come across someone else's data, stop, do not keep it and tell us.
• Respect the API limits and do not run tests that degrade the service for others.
• Do not use what you find for anything other than demonstrating the problem.
• Keep the finding confidential until we have fixed it or until [DISCLOSURE PERIOD — e.g. 90 days, confirm] have passed since your report, whichever comes first, and coordinate publication with us.

If you research and report in good faith following this policy, we will consider your research authorised, we will not take legal action against you for it and, if a third party does, we will make clear that you acted with our permission. [SCOPE OF THE SAFE HARBOUR — review with a lawyer]

This protection does not cover anyone who breaks the rules above, for example by accessing other customers' data beyond what is needed to demonstrate the problem.

• We acknowledge your report within [ACKNOWLEDGEMENT PERIOD — confirm].
• We give you a first assessment within [ASSESSMENT PERIOD — confirm].
• We keep you informed while we fix it and tell you when it is resolved.
• If you wish, we credit you as the finder when we publish it.

We do not have a monetary reward programme. [BUG BOUNTY PROGRAMME — confirm with the owner]