Security and vulnerability disclosure

Exchange rate boards and website widgets run on this service in shops around the world. If you find a security weakness in it, we want to hear about it privately, fix it, and thank you.

1. How to report

Email info@exchangerate.management with Security in the subject line. Please include:

• what you found, and where (the page, URL or API endpoint);
• the steps to reproduce it;
• what an attacker could do with it;
• the email address of any account you used for testing.

Please don't report a security issue in public: not in comments, social media posts or reviews. Other customers' boards run on the same service until it is fixed.

A board or widget that looks wrong, or a feature that doesn't work, is an ordinary bug. Send those through the contact form, choosing the topic "Bug".

2. What we do in return

• We acknowledge your report within three business days.
• We keep you updated while we investigate and fix it, and tell you when it is fixed.
• With your permission, we credit you by name when we write about the fix.

3. Scope

In scope: the exchangerate.management website and dashboard, including sign-in and billing pages; the APIs under /api; the MCP server; the embed script (/exchange-rates-embed.js); and the hosted TV board (/tv).

Out of scope:

• denial of service, load or stress testing, and high-volume automated scanning;
• social engineering of our team or our customers, and physical attacks;
• output from automated scanners without a demonstrated impact;
• missing security headers, cookie flags or email records (SPF, DKIM, DMARC) without a demonstrated exploit;
• clickjacking on pages with no sensitive action, self-XSS, and logout CSRF;
• rate-limit or brute-force reports without a demonstrated impact;
• our customers' own websites that embed the widget, and third-party services we use (such as Stripe, Supabase and Vercel). Please report those to their owners.

4. Rules for testing

• Test only with accounts you created. Never access, change or delete data that isn't yours. If you reach another account's data, stop, don't keep a copy, and tell us.
• Don't do anything that could slow the service down or take it offline. Every customer's board and widget depend on it.
• Use the least data you need to show the issue.
• Give us reasonable time to fix the issue before you disclose it publicly. We aim for 90 days and will agree a date with you.
• Don't ask for payment in exchange for withholding or deleting information.

5. Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not bring or support legal action against you for it. If a third party brings a claim about your research, we will make it known that you acted under this policy.

This policy covers only the services listed in scope. We cannot authorize testing of anyone else's systems, including our customers' websites and our providers.

6. How we thank valid reports

For the first report of a valid, in-scope vulnerability we didn't already know about, we offer 12 months of the Pro plan (a US$99.99 value) on your account, or 12 more months if you already subscribe. For a minor issue, or one already reported, we thank you and, with your permission, credit you.

This is a thank-you, not a bug bounty. There is no cash reward. Only the first report of an issue qualifies, and the decision is ours. It isn't available to our staff or contractors, or where the law or sanctions don't allow it.

7. Machine-readable contact

Our contact details are also published in /.well-known/security.txt, the standard file security researchers look for (RFC 9116).