1. How we protect your account
- Passwords are stored only as strong one-way hashes, never in readable form.
- All traffic is encrypted in transit with HTTPS.
- A strict content security policy, protection against cross-site request forgery, and rate limits on sign-in and other sensitive actions.
- Staff access is limited to the people who need it. Admin accounts require two-factor authentication.
- Payments are handled by Stripe. We never store card numbers.
2. Reporting a vulnerability
If you believe you have found a security vulnerability in Zanshin, please email security@zanshintraders.com. Include:
- a description of the issue and its likely impact;
- the steps to reproduce it, including the URLs, requests or screenshots involved;
- your contact details, if you would like us to follow up or credit you.
We aim to acknowledge reports within 3 business days and to keep you updated until the issue is fixed.
3. Rules for testing
- Only test against your own account, or test accounts you created. Never access, change or delete other users' data. If you come across someone else's data by accident, stop, do not keep it, and tell us.
- Do not degrade the Service for others, and keep automated testing to a gentle rate.
- Do not disclose the issue publicly, or to anyone else, until we have released a fix and agreed a disclosure date with you.
4. Good-faith safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised. We will not pursue legal action or report you to law enforcement for it, and we will work with you to understand and fix the issue. This safe harbour does not cover actions that harm users, damage data, or break the law in ways this policy cannot authorise. [Lawyer: review the scope of the safe harbour.]
5. Out of scope
- Social engineering or phishing of our staff, users or providers
- Denial-of-service attacks, or load and volume testing
- Physical attacks on offices or data centres
- Issues in third-party services we use (Stripe, Discord, our email or hosting providers). Please report these to the provider.
- Reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and self-XSS
- The Windows desktop app being unsigned. This is known and documented.
6. Rewards
We do not currently run a paid bug bounty. With your permission, we are happy to thank researchers publicly for valid reports.