Security & Vulnerability Disclosure

Last updated 2026-10-10

If you find a security problem in something we run, we want to hear about it, and good-faith research under this page will not be met with lawyers. Below: how to report, what counts, the rules, and — because impersonation is the real threat in a trading community — how we do and do not contact you, and how to keep your own keys safe.

1.How to report a vulnerability

If you have found a security problem in anything we run, tell us at [support@flosignals.com or flosignals@gmail.com — pick one] with "Security" in the subject. A machine-readable version of this contact is at https://flosignals.com/.well-known/security.txt.

Please include:

what the problem is and where (the page, the endpoint, the component);
steps to reproduce it, or a proof of concept;
what an attacker could do with it, as you understand it;
how we can reach you, and whether you want to be credited.

We acknowledge every report within [owner: proposed 3 business days], tell you what we found and when we expect to fix it, and let you know when it is fixed. Please give us a reasonable time to fix a problem before you describe it publicly; we will not ask you to stay silent for longer than that fix takes, and never for more than [owner: proposed 90 days].

2.What is in scope

Things we run, and that this policy covers:

the website and member pages at flosignals.com and its subdomains, including the Trade Journal and Quant;
FloCharts, the market-data recorder and the trade relay it talks to;
the platform that imports journal trades and seals exchange keys;
our Discord server's bots and integrations, where we wrote them.

Out of scope, because they are not ours — report them to their owners:

Whop, Toobit and other exchanges, Discord, TradingView, Vercel and Google, and anything on their domains;
denial of service, rate-limit exhaustion, or anything that degrades the service for other members;
social engineering of our staff or members, phishing, physical access;
reports from automated scanners with no demonstrated impact, missing best-practice headers with no exploit, and version disclosure alone.

3.The rules for research

While you look:

use your own accounts and your own data; do not access, change or delete another member's;
if you reach data that is not yours, stop, note what you reached, and tell us — do not copy it or go further;
never test against a live exchange account that is not yours, and never place, cancel or alter an order for anyone else;
do not run denial-of-service tests, spam, or anything that costs other members their session;
do not ask for money in exchange for the report before we have seen it.

4.Safe harbour

Security research carried out in good faith, within the rules above and within the scope above, is authorised by us. We will not take or support legal action against you for it, and we will not report it to law enforcement as an attack. If a third party takes action against you for research done under this policy, we will say that it was authorised. This does not cover research that goes outside these rules, and it cannot bind the third parties named as out of scope.

5.Rewards

We do not run a paid bug bounty today. [owner: say whether a thank-you (free membership, a payment at our discretion, public credit) is offered for valid reports] We credit reporters who want it on this page, once the fix has shipped.

6.Protecting your own account and keys

Most losses in trading communities come from impersonation, not from software. What is true of us:

We never message you first. Staff and moderators do not open a DM with you on Discord, Telegram, X or anywhere else. If someone claiming to be FloSignals does, it is not us.
We never ask for keys, secrets, passwords or seed phrases. Not an API key, not an API secret, not your Whop or Discord password, not a code from your authenticator, not a transfer "to verify your account". Nobody at FloSignals needs any of them, ever.
We never ask you to install anything to "fix" your access, and we never send a link to a sign-in page in a DM. Sign in only at flosignals.com, and check the address bar.

What we ask of you:

turn on two-factor authentication on Whop, on Discord and on every exchange account you connect;
create exchange keys without withdrawal permission, read-only where the journal is all they are for, and with an IP allowlist where the exchange supports one;
do not paste a key or secret into Discord, into Quant, or into a support message — a masked key id is all we ever need to help you;
sign out on shared computers, and tell us at once if you think your session or your Whop account was used by someone else;
keep your own direct access to your exchange, so you can manage a position if the chart or the relay is down.

7.How we protect the service

Everything travels over TLS. Your FloCharts trading secret never leaves your browser; the relay forwards requests your browser has already signed and cannot forge or alter them. Journal keys are sealed on our platform with a key held only in memory and are used through a fixed, read-only list of endpoints. Member sessions are signed cookies that expire in seven days; member tokens for the chart expire in 24 hours. The Privacy Policy says more. If we learn of a breach that affects you, we tell you without undue delay.

8.Contact

Security reports and questions: [support@flosignals.com or flosignals@gmail.com — pick one].