If you report a security vulnerability to us in good faith, in line with this policy, we will not pursue legal action against you, and we will work with you — not against you — to understand and fix the issue. We treat outside security research as a genuine part of how this app stays safe, not as an adversarial process.
In scope:
- The Capital Worthx web app at capital-worthx.com
- The API behind it (authentication, sessions, sync)
- Our 2FA, passkey/WebAuthn, and account-recovery flows
- Our client-side encryption implementation — this is the one we'd most want to know about first
Out of scope:
- Our infrastructure providers' own platforms (report those directly to them — Cloudflare, our email-delivery provider, our exchange-rate data provider)
- Social engineering of our team or our users
- Physical attacks against our offices or hardware
- Denial-of-service testing, or any automated scanning heavy enough to degrade the service for other users
- Spam or phishing campaigns run "to prove a point"
- Test only against an account you created yourself — never a real user's data
- If you do stumble onto another user's data, stop immediately and report it to us without accessing, modifying, or retaining any of it
- Give us a reasonable window to fix a confirmed issue before any public disclosure — 90 days is our default expectation, and we'll keep you updated throughout
- Don't demand payment as a condition of disclosure
Whatever you have is welcome, but a report is fastest to act on when it includes: clear steps to reproduce, the affected component or endpoint, the impact as you understand it, and any supporting screenshots or proof-of-concept — built against your own test account, never real user data.
- A good-faith acknowledgment that we've received your report
- Honest, ongoing communication while we investigate and fix it — no disappearing
- Credit in our security acknowledgments if you'd like it, or full anonymity if you'd rather
- No legal action for research conducted within this policy
Email us directly at pirinventures007@gmail.com. If you're reporting something sensitive, keep the initial email brief — steps to reproduce and impact are enough to start; we'll follow up for anything else we need.