Security
Report a vulnerability
If you believe you've found a security issue, email security@finwiseapp.io with the affected URL, steps to reproduce, the impact and any proof-of-concept. The same address is in our security.txt file, per RFC 9116.
Safe harbour for good-faith research
We will not pursue legal action against, or report to authorities, researchers who:
- Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
- Only interact with accounts they own or have explicit permission to test.
- Give us a reasonable window (we ask for 90 days) to remediate an issue before disclosing it publicly.
- Don't exploit a vulnerability beyond the minimum necessary to confirm it exists.
In scope
- The production web app at app.finwiseapp.io
- The backend API at api.finwiseapp.io
- The FinWise iOS and Android mobile apps
- This marketing site at finwiseapp.io
Out of scope
- Third-party services we integrate with but do not operate: Plaid, Yodlee, GoCardless, Gathr, Stripe, OpenAI, Heroku, Sentry, Intercom. Please report issues in those services directly to the provider.
- Social-engineering of FinWise staff, customers, or contractors.
- Physical attacks against FinWise infrastructure or offices.
- Denial-of-service (volumetric or rate-based) testing against production.
- Reports generated solely by automated scanners with no demonstrated impact.
What to expect from us
We aim to acknowledge reports within 3 business days, give an initial assessment within 10 business days, and keep you updated as we work on a fix. We do not currently operate a paid bug-bounty programme; we will, however, credit researchers in release notes (with permission) and are happy to help with responsible-disclosure publication timing.
