SecurityReply within 48 hours

Security vulnerability reporting

Du hast eine Schwachstelle in FuturesBot, auf futuresbot.de oder in unserer API gefunden? Melde sie uns bitte, bevor du sie veröffentlichst. Wir nehmen jede Meldung ernst, antworten in der Regel innerhalb weniger Werktage und gehen rechtlich nicht gegen Personen vor, die uns in guter Absicht und im Rahmen dieser Regeln auf ein Problem hinweisen.

support@futuresbot.de

How are you reporting

One email is enough. The more precise the description, the faster we can act.

Email to support@futuresbot.de

Subject please with „Security alert“ begin so that it does not get lost in regular support.

This helps us

Affected component and version, steps to reproduce, possible impact and — if available — proof. Screenshots or a short log are often enough.

What happens next

We confirm receipt within 48 hours, will get back to you within 7 days with an initial assessment and will keep you updated until it is resolved.

Our Commitments

Check mark No legal action against individuals who find a vulnerability in good faith and report it to us confidentially — as long as no third-party data is accessed, modified, or published, and no services are intentionally disrupted.
Check mark Confidential treatment of your report and your data.
Check mark Name mentioned upon request, once the problem is resolved.
Check mark Notification of affected customers, if a gap had an impact on them.

In exchange we ask you to allow us a reasonable period to remedy the issue\n before you publish details — 90 days is customary. For critical vulnerabilities\n we act considerably faster.

Scope

Enclosed

Check mark The FuturesBot software (full version and TradingView Edition)
Check mark futuresbot.de, including the online store and customer account
Check mark api.futuresbot.de (KI-Chat, Diagnose-Upload, Versionsabfrage)
Check mark Das Lizenz- und Update-System (Lizenzprüfung über www.futuresbot.de, Schnittstelle fb-lic/v1)

Not included

– Denial-of-service attacks (DoS/DDoS) and load tests
– Social engineering against us or our customers
– Spam, brute force against third-party accounts
– Third-party systems (exchanges, payment service providers, hosts)
– Pure configuration notes without security impact

Legal Background

As the manufacturer of a product with digital elements, we are subject to Regulation (EU) 2024/2847 (Cyber Resilience Act). Under it, we report actively exploited vulnerabilities and severe security incidents to the competent authorities within the statutory deadlines. This page is our point of contact for such reports.

We provide safety-relevant updates via the customer account — for at least 24 months from the date of purchase. Details in § 8 of the Terms and Conditions.

Privacy

Which data is processed where

Contact

For everything that is not a security notice

Version history

What's in the updates

⚠ Note: This page is exclusively for reports of security vulnerabilities. Questions about setup, operation, purchase or license are answered by the FAQ section or our support.

Stand: 05.10.2026