Security

What you can test#

This developer site. Forge in the Oathra app. The Oathra API that the app and this site call. The code sandbox that runs strategy and indicator code, including any way out of it. The chart service.

What is not in scope#

Denial of service and load testing. Phishing or social engineering of Oathra staff or users. Physical attacks. Services run by other companies, such as payment, hosting and email. Scanner output with no working proof.

How to report#

Write to security@oathra.com. Say how to reproduce the problem, which address or file it affects, and what an attacker would gain. Use only accounts you own. If you reach another person's data, stop and report it at once, and do not keep or share it.

Safe harbour#

If you follow this page in good faith, we will not take legal action against you for your testing.

What happens next#

We confirm that we received your report, check it, fix what is real and tell you when it is fixed. Please keep the details private until then.

Thanks#

With your permission, we name researchers who report a confirmed problem on this page.