Scope
The TupTrader website, accounts, checkout flow, product access, and public APIs are in scope.
Report a security vulnerability
Send reproducible details, impact, and a safe remediation suggestion. Do not send passwords, private keys, or unnecessary user data.
Testing boundary
Avoid data destruction, social engineering, service disruption, and access to another user’s data. Stop once impact is safely demonstrated.
What happens next
The form returns a tracking number. Security reports are retained for up to 90 days and then purged.