Report a security issue

Write to security@notonlystock.com. One person reads it. You will get a reply — if you do not within three days, resend to support@notonlystock.com, because it went missing.

What helps

What you did	The request, the response, and what you expected instead
What it lets someone do	Reading another account's data is different from a noisy error message. Say which
Your account	If you used one — it lets us find the calls

What we ask

Do not take other people's data	Prove access with your own account. If you land in someone else's data by accident, stop and tell us what you saw
Do not degrade the service	No load testing, no denial of service. The whole thing runs inside a free tier and it is easy to knock over
Give us time	We will tell you when it is fixed. Publish after that

There is no bug bounty — there is no revenue to pay one from. We will credit you by name on the fix if you want that, and say so plainly if you do not.

What the service already does

API keys are hashed	SHA-256. A database copy does not yield a working key, and we cannot show you your key again
Sessions are signed, not stored	The cookie is HttpOnly and carries its own signature. There is no session table to steal
Sign-in links expire	15 minutes, single use, stored hashed
Payment webhooks are verified	Standard Webhooks signature. An unsigned call adds no credits
Upstream errors are not echoed	A failure at a data source returns our own message, because the source's message can carry our credentials
IP addresses are hashed	Salted with a server secret, and only where we need to count. The raw address is never written

Known limitations

Said here rather than found later. There is no SLA and no on-call — a report that arrives at 3am is read in the morning. The service runs on one person's Cloudflare account, so an account compromise there is a total compromise. Credentials live as Cloudflare secrets and in one local .env; there is no vault and no rotation schedule.