We hold our own money in the portfolio this platform produces. That changes how we treat security. A breach here would not cost us a customer, it would cost us the thing the whole product is built on, which is the reason to believe a number we published.

This page is the front door for anyone who finds a problem. It is also the short version of how the platform is built, for readers evaluating us for a team, an integration or a data licence.

Reporting a vulnerability

Email [email protected]. One address, monitored, and it reaches the person who can fix the thing. There is no form and no ticket queue in front of it.

What helps us move fast:

• The URL or endpoint, and the account or role you were using at the time.
• What you did, in enough detail that we can reproduce it once.
• What you saw that you should not have seen, and what you think the impact is.
• A screenshot, a request log or a short recording if you have one.

Write in English or Hungarian. Both reach the same inbox and neither gets read more slowly.

What we commit to

• An acknowledgement within two business days. From a person, naming the report, not an autoresponder.
• An assessment within ten business days, telling you what we found, whether we agree on severity, and what we plan to do.
• A fix on a timeline that matches the risk. Anything touching account data or authentication goes to the front of the queue, ahead of whatever was shipping that week.
• Credit, if you want it. See below.
• We will tell you when it is fixed, so you can verify rather than take our word for it.

Safe harbour

Research it in good faith and we will treat you as someone helping us, because you are. Specifically, if you follow this page we will not pursue legal action, we will not report you, and we will not ask your employer or your hosting provider to do either.

Good faith here means:

• You use your own account, or an account you have permission to use.
• You stop as soon as you have proved the issue. Read one record, not the table.
• You do not degrade the service for anyone else. No load testing, no automated scanning that hammers the origin, no denial of service.
• You do not keep, publish or pass on any personal data you reach along the way, and you tell us what you saw so we can meet our own notification duties.
• You give us a reasonable window to fix it before going public. Ninety days is the norm, and we will usually be done long before that.

If you are unsure whether something is in bounds, ask first. We would rather answer an email than argue about one.

In scope

• returnolio.com and app.returnolio.com
• The Returnolio API and the MCP connector
• Our transactional and digest email

Out of scope

These come in often, and none of them is a finding on its own. Reports limited to this list get a polite reply and nothing else.

• Missing headers, cookie flags or TLS configuration with no demonstrated impact, including anything a scanner reports as a grade.
• Rate limiting, account enumeration by timing, or the absence of a CAPTCHA, unless you can show real harm.
• Self inflicted issues: self XSS, clickjacking on a page with no state changing action, or anything that needs a compromised device.
• Findings in third party services we use rather than run. Report those to the vendor.
• Social engineering of our staff, our users or our suppliers, and physical attacks of any kind.
• The content of our research. A score you disagree with is not a vulnerability, and we would genuinely like to hear about it at support@returnolio.com.

How the platform is built

The short version, for anyone doing diligence on us. The full detail sits in the Privacy Policy.

• Hosted in the EU. Hetzner Online GmbH, Falkenstein, Germany. Cloudflare sits in front of it.
• Encrypted in transit and at rest. TLS on every connection, encryption at rest for backups.
• Passwords are hashed with bcrypt, never stored or logged in a readable form. Passkeys are supported, and we prefer them.
• Least privilege access, with multi factor authentication required on every administrative account.
• Broker connections are read only. Where a portfolio is linked, the permission covers balances and positions. Nothing in the system can place a trade or move money, and that is a property of the architecture rather than a policy we promise to keep.
• The AI connector needs your explicit consent. It runs on OAuth 2.1 with a consent screen. Portfolio data reaches an assistant only after you approve that connection, and you can revoke any connection from your settings.
• Security review is part of shipping, not a quarterly event, and dependencies are patched on a schedule rather than on discovery.
• Host exposure is measured hourly, not reviewed. A job watches the firewall and every published port, and raises an alarm the moment something opens. A rule that only a person checks is a rule that gets broken quietly.

The most recent internal security review was completed on 6 September 2026. It covered secret handling, database access, every administrative endpoint, webhook signature validation and host exposure. We will send the summary to anyone evaluating us seriously. It is an internal review and we do not dress it up as an external audit; when we commission one of those, this is where it will be named.

Evaluating Returnolio for a team, or looking at our data for your own product? Email support@returnolio.com and we will walk you through the architecture properly, including the parts that are not on this page.

Acknowledgments

Researchers who report a genuine issue to us are listed here, with their name or handle and a link if they want one. Tell us how you would like to appear, or tell us you would rather not appear at all. Either answer is fine and neither changes how we handle the report.

No reports have been received to date. That is a young product talking, not an invitation, and we would like the first name on this list to be yours.

What this page is not

We do not run a paid bug bounty. There is no cash reward, and we would rather say so plainly than let anyone spend a weekend expecting one. What we offer is a fast, human response, public credit, and a fix you can verify.

Machine readable contact details for this page are published at /.well-known/security.txt in line with RFC 9116.