Scan for free
Last updated:

Report a vulnerability

We check the security of other sites, so we have to be especially careful with our own. If you have found a vulnerability in Hullwise, please tell us first. Thank you.

1How to report a vulnerability

Write to cem@cdcapital-group.com. Please don't report it publicly or on social media.

It helps to include:

  • Which address or component is affected: website, API or MCP server
  • What you did, step by step, so we can reproduce it
  • What someone could achieve with it
  • How we can reach you if we have questions

2What is in scope

  • The Hullwise website, the API under /api/v1 and the MCP server under /mcp
  • Ways to steer the check toward internal addresses, including through the JavaScript files it loads
  • Ways to access data of other accounts, such as history or keys
  • Bypassing the limits, the sign-in or the shortening of reports without a paid plan

3Rules for testing

  • Only test with your own account. Don't access other people's data, not even as proof.
  • No overloading, no denial-of-service attempts, no automated mass requests.
  • No social engineering against us or our service providers.
  • Please report vulnerabilities in Vercel, Supabase, Stripe or Resend directly to them.
  • Give us time to close the gap before you talk about it. We are happy to agree on a publication date with you.

4What you can expect from us

  • We confirm receipt of your report and keep you updated, usually within five business days.
  • We fix confirmed vulnerabilities as quickly as possible and let you know when that is done.
  • If you like, we credit you by name once the vulnerability is fixed.
  • If you follow these rules and act in good faith, you don't need to fear legal action from us.
  • There is currently no bug bounty program.

5security.txt

The contact details are also available in machine-readable form per RFC 9116 at /.well-known/security.txt. How the check tests other sites and what it never does is described under How we check.