GREEKSVIEW — Security

Last updated: August 2, 2026

Found a vulnerability? Please tell us. Email security@greeksview.com. We read every report, we will acknowledge you within three business days, and we will not pursue legal action against anyone who reports in good faith under the guidelines below.

How to report

Send us enough to reproduce the issue: the affected URL or endpoint, the steps you took, and what you observed. A proof of concept helps. If a report contains sensitive detail, say so and we will arrange another channel.

Please give us a reasonable window to ship a fix before disclosing publicly. We will tell you when the fix is live, and we are happy to credit you unless you would rather stay anonymous.

In scope

Authentication and session handling, including the admin console
Anything that lets one account read or modify another account's data
Server-side injection, remote code execution, or SSRF
Flaws in the Alpaca proxy that could expose one user's credentials to another
Cross-site scripting that survives our escaping
Broken access control on any /api/ or /admin route

Out of scope

Findings that require physical or already-authenticated access to a user's own device. Broker and AI API keys are encrypted in the browser with a non-extractable key and never reach our servers, so reading them from an unlocked machine is not a server-side flaw.
Missing security headers or TLS configuration with no demonstrated impact
Rate limiting on unauthenticated endpoints, absent a concrete attack
Automated scanner output without a working proof of concept
Social engineering of our staff or users, and physical attacks
Denial of service, volumetric testing, or anything that degrades service for real users

Please do not

Access, modify, or delete data belonging to anyone but yourself. Register a test account instead.
Run load or stress tests against production
Use a finding to place trades, move funds, or read another user's positions

What we already do

Some context that may save you time. Broker and AI credentials are encrypted client-side with a key that cannot be exported from the browser, so they are never transmitted to or stored on our servers. Session cookies are httpOnly and, in production, carry the __Host- prefix. The admin console uses entirely separate credentials with mandatory two-factor authentication, server-side sessions, and an append-only audit trail. Passwords are hashed with bcrypt, and email tokens are stored only as SHA-256 hashes.

No bounty, but real credit

We are a small independent product and do not run a paid bug-bounty programme. We will acknowledge valid reports here and credit you by name or handle if you would like.

Contact

security@greeksview.com · machine-readable version at /.well-known/security.txt

Fathomline Analytics LLC · 4601 E. Douglas Ave., Ste 150, Wichita, KS 67218