Responsible disclosure

We value the work of security researchers. If you believe you have found a vulnerability in any Wealtho app, website or API, please tell us so we can fix it.

How to report

Email contact@getwealtho.com with:

• a description of the issue and where it is;
• the steps to reproduce it;
• what an attacker could do with it.

What we ask of you

• Only test against your own accounts and data. Do not access, change or delete anyone else's.
• Do not move real money, degrade the service or run denial-of-service tests.
• Do not use social engineering, phishing or physical attacks against our staff or customers.
• Give us reasonable time to fix the issue before you share it with anyone.

What you can expect from us

• We will acknowledge your report and keep you updated while we investigate.
• We will not take legal action against research done in good faith and within this policy.
• With your permission, we will credit you once the issue is fixed.

Machine-readable contact details are at /.well-known/security.txt.