Security & Responsible Disclosure

Gotrade operates a regulated, cross-border investing platform that holds real customer funds and sensitive personal information. We take the security of our products and our customers seriously, and we value the work of the security research community. If you believe you have found a security vulnerability in any Gotrade product, we want to hear from you. This page describes how to report an issue, what is in and out of scope, the protections we extend to good-faith researchers, and how valid reports are recognised.

How to report

Email your report to security@tr8.io. This is the official channel for security issues, monitored by our engineering team. Please do not use personal inboxes, support chat, or social media, and please do not disclose an issue publicly before we have resolved it. Our machine-readable policy is published at /.well-known/security.txt. Please submit reports in English.

To help us triage quickly, please include:

A clear description of the vulnerability and the security impact it could have.
The exact product, URL, endpoint, or app screen affected.
Step-by-step instructions to reproduce it, including any required roles and request/response samples.
Proof-of-concept material (a screenshot, a short video, or a minimal script) where possible.
Your assessment of severity, and any suggested remediation if you have one.

Scope

The following Gotrade products and their supporting production APIs are in scope:

The Gotrade (Global) mobile app on the Apple App Store and Google Play, and its production API.
The Gotrade Indonesia mobile app on the Apple App Store and Google Play, and its production API.
Our public production API domains under tr8.tech that these apps use.
The public marketing website at www.heygotrade.com.

We are most interested in high-impact issues: remote code execution; authentication or authorization bypass; broken access control and IDOR that expose another customer's account, data, or funds; flaws that let a user trade without paying or manipulate pricing, orders, or balances; and bypasses of our identity (KYC) or anti-fraud controls.

Out of scope

The following are out of scope, and testing them is not authorised under this policy:

Our staff-only administrative and back-office consoles. These have no public sign-up and are not part of this program.
Any third-party service we integrate with, including brokers, banks, payment processors, and identity or screening providers. If a finding lets you reach a third-party system, document the path and stop; do not test their systems.
Any action that moves real money (deposits, withdrawals, transfers, or live orders that execute). These are irreversible; demonstrate the flaw without completing the transaction.
Accessing, downloading, or exfiltrating real customer personal data, KYC documents, or financial records. If you can prove exposure, capture the minimum evidence (a single redacted screenshot or one record identifier) and stop.
Denial-of-service, stress, load, or volumetric testing of any kind, and any automated scanning that degrades service.
Social engineering of our staff, customers, or vendors; physical attacks; and spam or phishing.
Reports from automated tools without a demonstrated, exploitable impact (for example missing headers, cookie flags, weak TLS ciphers, version banners, self-XSS, or theoretical CSRF on unauthenticated forms).

Rules of engagement

Use only test accounts you have registered yourself. Never access, modify, or delete data belonging to other customers.
Stop as soon as you have confirmed a vulnerability. Do not pivot deeper, escalate, or maintain access.
Do not test in a way that could disrupt live trading. Where possible, prefer our staging environments; contact us if you need access.
Keep the details of any issue confidential until we confirm it is resolved and agree on a disclosure timeline.
One report per vulnerability. If you find the same class of issue in several places, group them into a single report.
Comply with all applicable laws.

These rules are the boundary of the program. Research that crosses them (pivoting after confirmation, taking more than the minimum evidence, disrupting service, or touching customer funds) forfeits both the reward and the safe harbor, however valid the underlying finding.

What you can expect from us

We aim to acknowledge your report within 3 business days.
We will validate the issue, keep you updated on our progress, and let you know when it is resolved.
We will handle your report confidentially and will not share your details with third parties without your permission.
We will work with you on a coordinated disclosure timeline, and where your report leads to a fix we are glad to credit you publicly, with your consent (see Acknowledgments below).

Safe harbor

“Good-faith security research” means accessing a system only to test, investigate, or help correct a security flaw or vulnerability, carried out in a way designed to avoid harm to individuals or the public, and where what you learn is used primarily to improve the security of the systems in scope and of the people who use them.

We consider good-faith security research conducted in accordance with this policy to be authorised. We will not bring or support legal action against you, and will not report you to law enforcement, for good-faith security research carried out under this policy, including for bypassing technological measures we use to protect the applications in scope. We waive any restriction in our Terms of Service or Acceptable Use Policy that would conflict with good-faith security research as described here, to the extent your activity stays consistent with this policy. If a third party brings legal action against you for research you carried out in good-faith compliance with this policy, we will take steps to make known that your activity was authorised.

To stay within this protection, make a good-faith effort to avoid privacy violations, destruction of data, and interruption of our services; interact only with accounts you own or have explicit permission to access; and give us reasonable time to resolve an issue before any disclosure. This safe harbor applies only to legal claims within our control; it does not bind third parties, and it does not authorise activity that breaks applicable law. If you are unsure whether an action is authorised, contact us first at security@tr8.io.

A report is a gift, never a demand. If you condition the details of a vulnerability on payment, threaten to publish or sell it, or use it to access or move anything, you are not participating in this program: no reward will be paid, the safe harbor does not apply, and we will treat the activity as an unauthorised attack.

Recognition & rewards

We recognise researchers who help us keep our customers safe. Where a report is valid, in scope, and new to us, we may offer a reward, paid directly to you by bank transfer. Whether we reward a report, and the amount of any reward, is at Gotrade's sole discretion; we do not publish fixed tiers, and a reward is not a contractual entitlement. The amount reflects the potential impact of the flaw as we assess it, and the quality of the report; the issues that matter most, those affecting customer funds, account access, or personal data, earn the most. You never need to demonstrate actual harm: a clear proof-of-concept stopped at first evidence earns the full reward for that severity. Going further does not increase the reward, and can void it.

If we decide to reward a report, we pay by bank transfer to the researcher directly. You provide the payee details we need to make the payment; you do not need to send us an invoice, and you do not need a VAT or tax registration number. If you already hold a Gotrade account in your own name, and the rules of that product allow it, you may choose to receive the reward as a credit to that account instead. Rewards are released against a signed reward acceptance, a short form confirming that you have reported everything you found, retain no access or data, and have stopped testing. You are responsible for any tax that applies to a reward in your own country. Duplicate reports, issues already known to us, and out-of-scope findings are not eligible for a reward. We offer public credit for every valid report, whether or not it carries a reward, and only with your consent.

Rewards are payments, and we can only make them where the law allows. Before any reward is paid, the payee must pass our sanctions and identity screening: we do not pay a reward to any person who is subject to sanctions, is otherwise a restricted person, or is resident in a jurisdiction we are prohibited from paying. Any other screening finding about a payee, including their history, is considered case by case at our sole discretion. Where we cannot lawfully pay you, you still receive our thanks and, with your consent, public credit, but no monetary reward and no alternative form of settlement.

Acknowledgments

We are grateful to the researchers who have responsibly disclosed security issues to Gotrade. With their permission, we recognise their contributions here.