Report a Security Issue

Thank you for taking the time to disclose responsibly. We take all reports seriously and aim to acknowledge within 2 business days.

How to reach us

Email (preferred): security@mirrorsecurity.io
PGP key: /security/pgp.txt
Fingerprint: 6B74 4F27 BD22 BCF0 7515 57CA 53BA A771 0745 880D
Please encrypt sensitive findings to the key above.

What to include

Affected product or domain (e.g. platform.mirrorsecurity.io)
Clear steps to reproduce
Impact — what could an attacker do with this?
Your name or handle for credit (optional)

In scope

Production domains: mirrorsecurity.io, platform.mirrorsecurity.io

etf.mirrorsecurity.io

Mirror Security platform application and APIs
Authentication and authorization on Mirror-operated services

Out of scope

Denial-of-service or resource-exhaustion attacks
Social engineering of Mirror Security staff or contractors
Physical attacks on Mirror facilities
Findings on third-party services we depend on (please report directly to those vendors)
Findings already publicly disclosed

Compensation

At present we do not have an active compensation program, but when we prepare to launch our bug bounty program we'd be happy to discuss potential collaboration opportunities with you.

Safe harbor

We will not pursue civil action or initiate complaints with law enforcement for research conducted in good faith following this policy. See our full vulnerability disclosure policy for details.

Other contact

For non-security inquiries, email hello@mirrorsecurity.io instead.

Last updated 2026-05-03 · security.txt