Report a vulnerability
How to report a security issue, and what we promise in return.
Found a security issue? Email security@euporia.money. Use synthetic data in your report, never anyone's real financial data, credentials or tokens.
Our full policy follows.
Security policy
Euporia is a personal-finance service, so we take reports about its security seriously and we want to hear from you. This policy covers how to report a vulnerability, what we promise in return, and what we ask of you.
How to report
Email security@euporia.money in English or Greek. Please include:
- what is affected (URL, endpoint, app version or file),
- steps to reproduce, or a proof of concept,
- the impact you think it has,
- whether you want to be credited, and under what name.
Use synthetic data in the report. Don't attach anyone's real financial data, credentials or tokens, even if you came across them.
Machine-readable contact details are at
/.well-known/security.txt.
Scope
In scope:
euporia.moneyand its subdomains, including the API (/api/*)- the Euporia mobile app, once it is published
- the code in this repository
Out of scope:
- services we use but don't run, such as Plaid, Stripe, Neon, Vercel, Upstash, Resend and Anthropic. Please report those issues to the vendor.
- denial of service, load or volumetric testing
- social engineering, phishing, or physical attacks on people or offices
- automated scanner output without a demonstrated impact
- missing headers or best-practice settings that have no exploitable impact
- self-XSS, and clickjacking on pages with no sensitive action
What we promise
| Step | Target |
|---|---|
| Acknowledge your report | 3 business days |
| Fix or mitigate a critical finding | 48 hours |
| Fix or mitigate a high finding | 7 days |
| Fix or mitigate a medium finding | 30 days |
| Fix or mitigate a low finding | 90 days |
| Keep you informed | at triage, at the fix, and before disclosure |
Fix times count from your report, or from public disclosure if that comes first. We rate severity with CVSS and tell you the rating we chose. If we can't meet a target, we tell you why and when we expect to.
What we ask of you
- Test only against accounts you own or have permission to use.
- If you reach data that isn't yours, stop, don't keep or share it, and tell us in your report.
- Don't change or delete data, and don't degrade the service for others.
- Give us a reasonable chance to fix the issue before you disclose it. We aim to agree a date with you, normally no later than 90 days after your report.
Safe harbour
If you act in good faith and follow this policy, we consider your research authorised. We won't take legal action against you or report you to law enforcement for it, and if a third party takes action against you, we will make it known that you acted under this policy. If you're unsure whether something is allowed, ask us first at security@euporia.money.
Rewards
There is no paid bug bounty yet. We credit researchers who want to be named. A paid programme, starting as a private one, is planned before Euporia scales (Gate 3 in the security programme).
Regulatory reporting
Pending lawyer review. Once the mobile app is distributed in the EU, it is a product with digital elements under the Cyber Resilience Act. From 11 September 2026, we must report actively exploited vulnerabilities in it, and severe incidents affecting it, through the ENISA single reporting platform. Reports go to the CSIRT designated as coordinator and to ENISA, as an early warning within 24 hours, a notification within 72 hours and a final report. If your report shows active exploitation, we may have to make that report. We'll tell you before we do, and won't name you without your consent.
Last updated on