Vulnerability Disclosure Policy

Owner: Security officer Effective date: 2026-07-19 Version: 1.0 Public contact: sales@wealthy.to

1. Purpose

WealthY welcomes reports from security researchers, customers, and members of the public about vulnerabilities that could affect our platform, our customers, or the individuals whose data we handle. This policy explains how to report a vulnerability, what to expect after reporting, and the safe-harbor protections we extend to good-faith researchers.

2. Scope

This policy covers WealthY-owned assets:

• The application at wealthy.to and any subdomain (app.wealthy.to, api.wealthy.to, www.wealthy.to)
• The WealthY mobile apps (iOS + Android)
• Any WealthY-published API endpoint
• Public marketing pages, blog posts, and legal documents
• WealthY-published open-source repositories

Out of scope: - Third-party services WealthY integrates with (Supabase, Vercel, Google Cloud, etc.) --- report those to the vendor directly - Customer-owned integrations, custom code, or misconfigurations - Social engineering, physical security, and denial-of-service testing - Test / staging environments not linked from wealthy.to

3. How to report

Send a report to sales@wealthy.to with:

• Description of the vulnerability and the affected asset
• Steps to reproduce --- enough detail that our team can confirm
• Impact assessment --- what a real attacker could do with it
• Any proof-of-concept code, screenshots, or logs
• Your name + preferred contact method (or "anonymous" if you prefer)

For sensitive reports involving Customer Data or authentication bypass, write "sensitive, request encrypted channel" in the subject and we will agree an encrypted channel with you before you send details. No PGP key is published today.

4. What to expect from us

• Acknowledgement within 3 business days --- a human will confirm receipt of your report
• Triage within 7 business days --- we validate the finding and assign a severity
• Progress updates every 14 days until the issue is resolved or dismissed
• Fix + disclosure timeline:
• Critical: within 30 days
• High: within 60 days
• Medium: within 90 days
• Low: within 180 days
• Public disclosure coordinated with you after the fix ships, unless you prefer to remain silent
• Recognition, with your permission, when the fix is disclosed
• Non-financial thank-you --- WealthY does not currently run a paid bug-bounty program, but we recognize responsible disclosure with public credit and, at our discretion, WealthY-branded merchandise

5. Safe harbor

WealthY will not initiate legal action against researchers who:

• Make a good-faith effort to comply with this policy
• Report the vulnerability promptly and give us reasonable time to fix it before public disclosure
• Do not exfiltrate more Customer Data than is necessary to demonstrate the vulnerability
• Do not intentionally harm WealthY, our customers, or the individuals whose data we handle
• Do not attempt to access other customers' accounts or data beyond what is necessary to demonstrate the issue
• Do not degrade the availability of the Service for other users

If you make a good-faith attempt to comply with this policy but inadvertently step outside it (for example, by exceeding the minimum data needed to prove a vulnerability), please notify us immediately. We will work with you rather than pursue legal action.

6. Ineligible reports

We will not consider or reward:

• Reports of missing security headers that have no demonstrable exploit
• Reports from automated scanners without manual verification
• Social engineering attacks against WealthY employees
• Physical attacks against WealthY facilities or personnel
• Denial-of-service or brute-force attacks
• Findings only reproducible on outdated browsers or plugins
• Missing "best-practice" configurations without a demonstrable exploit
• Reports of publicly known vulnerabilities in third-party dependencies where we have already begun patching

7. Legal

This policy does not authorize any activity that would violate Canadian or applicable local law. Researchers must comply with the Criminal Code of Canada, PIPEDA, and any applicable regulations.

By submitting a report, you grant WealthY a non-exclusive, royalty-free, worldwide license to use your report to remediate the vulnerability. You retain all other rights.

8. Contact

• Security reports: sales@wealthy.to
• General questions: sales@wealthy.to
• Legal questions about this policy: sales@wealthy.to

Machine-readable version of this contact information is published at wealthy.to/.well-known/security.txt per RFC 9116.

1001536620 Ontario Corp., carrying on business as WealthY · Ownership and legal information