# Bug Bounty Program ## Purpose The purpose of this BugBounty Program is to provide a clear and legally binding process for security researchers to report potential security vulnerabilities affecting our services, systems, or infrastructure, and to define the conditions under which such research activities are authorized. # Scope This program applies to: - Web-App TraderFox - traderfox.de - traderfox.com - aktie.traderfox.com - quotes.traderfox.com - Mobile App Finanzen.net - https://play.google.com/store/apps/details?id=com.traderfox.mobile.app - https://apps.apple.com/de/app/traderfox/id1174805527 Out of scope: - All (sub)domains not listed above - All 3rd parties, including those used in our mobile apps Researchers must add headers to requests identifying their testing activity: “X-BugBounty-Researcher: ” ## Important Notice on Testing We do NOT provide a dedicated test or sandbox environment. ## Prohibited Activities The following activities are prohibited by applicable law (in particular the German Criminal Code (StGB)) and are NOT authorized by this program. Performing them will result in immediate exclusion from the program, forfeiture of any bounty, and may lead to legal action and to mandatory reporting by us: - Interfere with other users’ accounts - Generate excessive traffic that could degrade platform performance - Exploit vulnerabilities beyond what is strictly necessary to demonstrate their existence - Access, copy, modify, or exfiltrate any personal data of third parties (including other clients) beyond what is strictly necessary to demonstrate the existence of a vulnerability - Conduct testing using the account or credentials of another person Unauthorized access and abuse remain strictly prohibited and may be subject to legal action. If you believe you have identified a vulnerability in one of our systems, please note that mandatory legal obligations (including but not limited to data protection obligations under the GDPR) always take precedence over this policy. ## Authorization and Safe Harbor ### Express Authorization (§§ 202a et seq. German Criminal Code) Subject to and conditional upon full compliance with this policy, we hereby grant security researchers express authorization (“Einwilligung” within the meaning of §§ 202a, 202b, 202c of the German Criminal Code / StGB) to access the in-scope systems listed above for the sole purpose of identifying and reporting security vulnerabilities. This authorization is strictly limited to the in-scope systems and to the activities expressly permitted by this policy. It does not extend to any other system, to the activities listed under “Prohibited Activities,” or to any conduct that violates applicable law. ## Safe Harbor (Conditional) If you act in good faith and in compliance with this policy, we will not: - initiate or support civil legal action against you in connection with your research activities; - file a criminal complaint (“Strafanzeige”) against you; or - voluntarily disclose your identity to law enforcement authorities, provided that none of the activities listed under “Prohibited Activities” occurred and no third-party rights (including the rights of our clients) have been violated. ### Mandatory Reporting Certain reporting obligations apply directly to us: - Notification of personal data breaches under Art. 33 GDPR and any other obligations to which we are directly subject Where reporting is mandatory, it will be carried out in accordance with applicable law. To the extent legally permitted, we will not include the identity of the reporting researcher in such notifications. Mandatory reporting that does not name the researcher does not constitute a violation of the safe harbor set out above ### Limits of Safe Harbor This safe harbor does not apply to: - Accessing, modifying, or exfiltrating client data - Any activity that violates criminal law - Any activity outside the defined scope of this program - Public disclosure of a vulnerability before remediation and without prior written consent ## Responsible Disclosure Guidelines When reporting a vulnerability, you must: - Provide a clear description of the issue - Include steps to reproduce the vulnerability - Include proof-of-concept (non-destructive only) - Describe the potential impact - Suggest remediation if possible - Submit the report in English or German - Disclose whether the report (or any substantial part of it) was generated or assisted by automated tools, including AI / large language models, and whether the findings have been manually verified by you ### Confidentiality By submitting a report, you agree to keep the reported vulnerability and all related information strictly confidential until we have remediated the issue. You may not publicly disclose the vulnerability or share details with third parties without our prior written consent. Coordinated public disclosure may be agreed upon in writing after remediation, typically not earlier than 90 days after the vulnerability has been confirmed fixed. Breach of this confidentiality obligation results in forfeiture of any bounty and may lead to legal action. Non-qualifying vulnerabilities: - Social engineering attacks against employees or clients - Load/Stress-Tests, DDoS, Email bombing - Automatic Vulnerability Scanner Results - Physical security testing of offices or data centers - Missing Best Practices - Self-XSS - Vulnerabilities that are limited to browsers no longer supported by the manufacturer - Banner grabbing/Version disclosure - Disclosing API Keys without proven impact - Reports that state that software is out of date/vulnerable without a proof-of-concept - Reports primarily generated by automated tools or AI without meaningful human verification, analysis, or impact demonstration ## Reporting Process Submit vulnerabilities via: - Email: contact-security@finanzen-zero.net We aim to: - Acknowledge receipt within 3 business days - Provide an initial assessment within 5 business days - Provide a final assessment within 10 business days - Keep you informed of progress where appropriate - Work towards timely remediation based on severity ## Bounty and Rewards We offer voluntary, discretionary monetary rewards for valid and impactful vulnerability reports. The amounts indicated below are non-binding guidance values; researchers acquire no legal right to a bounty by participating in this program. Any payment is made ex gratia and at our sole discretion. Eligibility considerations include: - Severity and potential business impact of the vulnerability - Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity - Quality and clarity of the report - Reproducibility of the issue Important conditions: - Rewards are granted at our sole discretion - Only the first valid report of a vulnerability is eligible - In case that a reported vulnerability was already known to the company from their own tests or other reporting, it will be flagged as a duplicate - The vulnerability must be reported in accordance with this policy - Any activity that violates the Testing or Legal and Regulatory sections will disqualify eligibility - Vulnerabilities detected by employees or former employees of Finanzen are welcome but excluded from any rewards. - Publicly disclosed Vulnerabilites are excluded from any rewards. - Researchers are responsible for any taxes and social security contributions arising from a bounty payment in their respective jurisdiction. We may require provision of tax-relevant information (name, address, tax ID) before payout. Payouts to recipients in jurisdictions subject to international sanctions are excluded We may request additional validation or collaboration before awarding a bounty. The following table gives a rough guideline on what to expect for a bounty. A service with a lesser business impact might be evaluated lower. These values are indicative ranges only and do not constitute an offer (“Auslobung”) within the meaning of § 657 of the German Civil Code (BGB). No legal entitlement to any bounty arises from this table. INFO | LOW | MEDIUM | HIGH | CRITICAL 0-50€ |25-100€|100-300€|300-600€|600-3000€ ## Handling of Sensitive Data If you encounter personal data of third parties or other sensitive information (e.g. account data, identification documents): - Stop testing immediately - Do not copy, store, transmit, or share the data - Report the issue as soon as possible - Securely delete any data inadvertently obtained immediately after reporting and confirm deletion to us in writing - Acknowledge that you act under a strict confidentiality obligation with respect to any such data, also after the end of your participation in this program ### Governing Law and Jurisdiction This policy and any participation in the program are governed by the laws of the Federal Republic of Germany, excluding the conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG). The exclusive place of jurisdiction for all disputes arising out of or in connection with this program is, to the extent legally permissible, the registered seat of the operating entity. Mandatory consumer protection rules in the researcher’s country of habitual residence remain unaffected. ## Updates We may update this policy at any time. The version applicable to a given report is the version published on our website at the time the report is submitted. We will indicate material changes by updating the version date below. Continued participation implies acceptance of the current version. Version: 1.0 - Date: 01.06.2026 ## Contact For all security-related inquiries: contact-security@finanzen-zero.net By participating in this program, you agree to act responsibly, ethically, and within the boundaries defined above.