Vulnerability Disclosure Policy

Adaptive Investing · Effective October 9, 2026 · Last updated October 9, 2026

The short version: If you find a security vulnerability in adaptive-investing.com, email contact@adaptive-investing.com. If you follow this policy in good faith, we will treat your research as authorized and will not pursue legal action. We acknowledge reports within 5 business days. There is no bug bounty.

1. Introduction

Adaptive Investing is a free educational tool operated by an individual based in California. We take the security of the Service seriously and welcome reports from security researchers and members of the public. This policy explains what research is in scope, how to send us a report, and what you can expect from us. It is adapted from the vulnerability disclosure policy template published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

2. Authorization (Safe Harbor)

If you make a good-faith effort to comply with this policy during your security research, we will consider your research to be authorized. We will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action related to your research. If a third party starts legal action against you for activities you conducted in accordance with this policy, we will make this authorization known.

This authorization covers only our own systems in scope below. We cannot authorize testing of third-party services.

3. Guidelines

Under this policy, "research" means activities in which you:

Notify us as soon as possible after you discover a real or potential security issue;
Make every effort to avoid privacy violations, degradation of the user experience, disruption to production systems, and destruction or manipulation of data;
Only use exploits to the extent necessary to confirm a vulnerability's presence, and do not use an exploit to compromise or exfiltrate data, establish persistent access, or pivot to other systems;
Stop testing and notify us immediately if you encounter any personal data, and do not keep, copy, or share it;
Give us a reasonable amount of time to resolve the issue before you disclose it publicly;
Do not submit a high volume of low-quality reports.

4. Test Methods Not Authorized

Denial-of-service (DoS or DDoS) tests or any other test that impairs access to, or damages, a system or data;
High-volume automated requests, including to the scoring API, which calls rate-limited third-party data services;
Social engineering (for example, phishing or vishing) of anyone, including our providers;
Spam, or sending unsolicited messages through any form or list, including the waitlist;
Physical testing of any facility.

5. Scope

In scope: the website and web application at adaptive-investing.com.

Out of scope: everything else, including:

Third-party services we use, such as Railway (hosting), Cloudflare (DNS and network services), Beehiiv (the waitlist, including any page Beehiiv hosts for us), and our data providers. Please report vulnerabilities in those services to the vendor under its own disclosure program.
Denial of service, social engineering, and spam, as described in Section 4.

If you are not sure whether a system is in scope, email us before you test.

6. How to Report a Vulnerability

Email contact@adaptive-investing.com with "Security" in the subject line. Please include:

A description of the vulnerability and where it is (the URL or endpoint);
The steps needed to reproduce it, with any proof-of-concept;
The potential impact, as you understand it.

Please do not include other people's personal data in your report. You do not need to give us your name. If you share contact details, we will use them only to communicate with you about the report.

7. What You Can Expect from Us

We will acknowledge your report within 5 business days.
We will confirm whether we can reproduce the issue and keep you informed as we work on a fix.
We will be as transparent as we can about the steps we take and any issues that delay a fix.
With your permission, we are happy to credit you once the issue is resolved.

No bug bounty. We do not offer payment or other rewards for vulnerability reports.

8. Questions

Questions about this policy can go to contact@adaptive-investing.com. This policy is also referenced from our security.txt file.

This Vulnerability Disclosure Policy was last updated on October 9, 2026.