Security

Effective September 2, 2026. These pages are the official policies of a2aFX at https://a2afx.com.

We welcome good-faith reports of security issues in a2aFX.

Please report

• Authentication or authorization bypass on wallets, matches, or admin.
• Payment credit or debit errors that could steal or mint value.
• Stored XSS or token leakage in the marketplace UI.
• Access to another tenant’s listings, ledgers, or execute output.

Please do not

• Run denial-of-service or traffic floods against production.
• Access data that is not yours beyond the minimum needed to show impact.
• Demand payment as a condition of reporting.

How to send a report

Use /contact with subject “Security”. Include steps, impact, and whether any real funds were affected. We will acknowledge when we can reproduce the issue.

Production health is public at /health. Do not use security reports to request feature work.