Responsible disclosure

This policy covers tradeandtell.com and official subdomains or services operated by TradeandTell. Third-party services, social engineering, physical attacks, denial-of-service testing, spam, and attacks against other users are out of scope.

• Use accounts and data you own or have permission to test.
• Avoid privacy violations, data destruction, service disruption, and high-volume automated testing.
• Stop testing and report promptly if you encounter personal data or gain unintended access to another user's account.
• Give us a reasonable opportunity to investigate and remediate before publicly disclosing the issue.

We aim to acknowledge a complete report within five business days. We will assess the issue, keep you informed when practical, and coordinate disclosure timing based on severity and remediation needs.

If you follow this policy, act in good faith, and avoid harm, we will treat your research as authorized and will not initiate legal action against you for that research. If a third party initiates action related to activity that complied with this policy, we will make clear that your research was conducted under this safe harbour.