Listed

Vulnerability disclosure policy

How to report a security weakness in Listed, what is in scope, what not to do, and the safe harbour we give good-faith research.

Version 2026-10-17Updated Oct 17, 2026

Draft. This document is awaiting review by counsel and may change. If it does, the new version will be dated and we will say what changed.

Contents, 6 sections
  1. Scope
  2. Safe harbour
  3. What not to do
  4. How to report
  5. What we promise
  6. Telling others

Listed is a service operated by Valor Security.

Effective Oct 17, 2026. Version 2026-10-17.

If you find a security weakness in Listed, we want to hear about it. This policy says what you may test, how, and what we promise in return. It is linked from /.well-known/security.txt.

Scope

In scope:

  • the website at www.listed.markets, including sign-in, accounts, leagues, checkout flows and the account pages;
  • the public API under /api/v1;
  • the MCP server at /mcp;
  • the OAuth authorization server and its metadata documents;
  • the domain that serves uploaded files.

Out of scope:

  • services we use but do not run, such as Stripe, Google, GitHub and our cloud provider. Report weaknesses in those to their owners;
  • physical security, and our staff;
  • findings that need a compromised device, an outdated browser or physical access to a victim's device;
  • missing best-practice headers or email settings, with no demonstrated way to exploit them;
  • reports from automated scanners with no proof that the issue is real.

Safe harbour

If you act in good faith and follow this policy:

  • we consider your research authorized, and we will not bring legal action against you or ask anyone else to;
  • we treat your research as exempt from the anti-scraping, rate-limit and security rules of our Acceptable use policy, to the extent your testing needs it;
  • if someone else brings a claim against you over research that followed this policy, we will make it known that your work was authorized.

Good faith means you avoid harm to the service and its members, you stop once you have shown the problem, and you give us a fair chance to fix it before you tell anyone else.

What not to do

  • Do not take data. Use accounts you created for testing. If you reach another person's data, stop, do not copy, keep or share it, and tell us what you saw. Show the minimum needed to prove the issue.
  • Do not disrupt the service. No denial-of-service testing, no load testing, no actions that degrade the site for others, and no automated scanning at a volume that does.
  • Do not change or delete anything that is not yours.
  • No social engineering of members or staff, no phishing and no physical attempts.
  • No real payments with cards that are not yours. Checkout runs in Stripe; do not test Stripe itself.
  • Do not plant anything that persists, such as a backdoor or malware.

Our security logs record activity on the service, including yours, as the Privacy policy describes. A clear description of what you did, and when, helps us match your report to what we saw.

How to report

Email security@listed.markets with:

  • what you found and where (the URL, endpoint or tool);
  • the steps to reproduce it;
  • what an attacker could do with it;
  • the time and the IP address you tested from, if you can share them;
  • how you would like to be credited, if at all.

If the issue is sensitive, ask us for an encryption key before sending details.

What we promise

  • We acknowledge your report within 3 working days.
  • We tell you whether we can reproduce it, and how serious we think it is, as soon as we have looked.
  • We keep you updated until it is fixed, and tell you when it is.
  • We credit you publicly, if you want, once it is fixed.

We do not currently pay rewards for reports.

Telling others

Please give us 90 days from your report, or until we confirm a fix if that is sooner, before you publish details. If we need longer, we will explain why and agree a date with you.

Other documents