Talis Bug Bounty

The following are not eligible for rewards:

• Duplicate reports.
• Reports without clear reproduction steps.
• Automated scanner output without validation.
• Theoretical issues without demonstrated impact.
• Social engineering, phishing, or impersonation.
• Denial of service, traffic flooding, spam, or resource exhaustion.
• Attacks requiring physical access.
• Testing on assets not explicitly listed in scope.
• Third-party issues without a direct Talis-specific exploit path.
• Self-XSS.
• Clickjacking on pages with no sensitive actions.
• Missing security headers alone.
• Version disclosure.
• SPF, DKIM, DMARC, TLS, DNS, or other best-practice findings without a real exploit path.
• Attempts to bypass plan limits, referral mechanics, promotions, rewards, or growth systems.
• Bugs that require compromising another user, employee, or vendor account.
• Feature requests submitted as fake bug reports.
• Requests for payment before enough detail is shared to validate the issue.

Low-value informational findings may be acknowledged but are unlikely to qualify for a reward.

Please follow these rules while testing:

• Only test on accounts you own or have explicit permission to use.
• Do not target other users’ accounts, balances, portfolios, orders, or data.
• Do not attempt to place, alter, cancel, or manipulate trades on behalf of others.
• Do not attempt to modify balances, withdrawals, account state, or financial records beyond the minimum needed to prove an issue.
• Do not use excessive automation or request volume.
• Do not degrade or interrupt service.
• Stop testing as soon as you confirm the issue exists.
• Do not exfiltrate, retain, or share sensitive data.
• Do not pivot to other systems or attempt persistence.
• Do not publicly disclose an issue before Talis has had reasonable time to address it.

Because Talis is a trading product, researchers must avoid any testing that could create real financial harm, market manipulation, unauthorized trades, or changes to production balances or order flow.

If you make a good-faith effort to follow this policy, test only in scope, avoid harm, avoid privacy violations, and promptly report what you find, Talis will consider your actions authorized under this policy and will not initiate legal action against you for that research.

If a third party initiates legal action against you for activities that were conducted in compliance with this policy, Talis may take steps to clarify that your actions were authorized under this policy.