Security and Responsible Disclosure

All traffic uses HTTPS. Broker credentials, API keys and access tokens are encrypted at rest and used only for the connection you turned on. Sign in is through Whop, so we do not store passwords. Access to production systems is limited to people who need it, and sensitive actions are logged.

If you believe you have found a security issue, email legal@realbmtrades.com with “Security” in the subject, a description, the steps to reproduce it and the impact. Please do not include other members’ data. We will acknowledge your report, keep you updated, and credit you if you want once it is fixed.

We will not pursue legal action against good faith research that follows these guidelines: only test against your own account; do not access, change or delete other members’ data; do not degrade the service (no denial of service, spam or social engineering of members or staff); do not place real trades or orders through anyone else’s connection; stop and report as soon as you find an issue; and give us reasonable time to fix it before telling anyone else.

Reports from automated scanners without a demonstrated impact, missing best practice headers without an exploit, issues in third party services such as Whop, brokers or Plaid (please report those to them), and physical or social engineering attacks.

A machine readable version of this policy is published at /.well-known/security.txt.