MagicTradeBot
Download
Security · Last updated: May 23, 2026

Incident Reporting

How to report security incidents, vulnerabilities, and suspicious activity — what we do with your report, and our coordinated response timeline.

01

Purpose

This policy outlines the procedures for reporting security incidents, vulnerabilities, or suspicious activity involving MagicTradeBot. Timely, accurate reporting enables us to reduce risk, protect user data, maintain service reliability, and fulfil our regulatory obligations under GDPR and CCPA.

This policy applies to all users, researchers, employees, and third parties who interact with the MagicTradeBot platform, website, or APIs.

02

What to report

Report any activity you believe poses a security risk to MagicTradeBot or its users. The following are always reportable:

Incident type Examples Severity
Phishing & social engineering Emails, calls, or messages impersonating MagicTradeBot High
Unauthorised access Suspicious logins, account takeovers, API key abuse Critical
Data exposure Any exposure of personal data, credentials, or trading information Critical
Platform vulnerabilities Bugs, misconfigurations, authentication bypasses, injection flaws High / Critical
Malware distribution Harmful links or files distributed through MagicTradeBot channels Critical
Insider threats Suspicious behaviour by staff, contractors, or third-party integrations High
Denial of service Coordinated attacks targeting platform availability High
✓
Not sure if it's reportable? Report it anyway. We would rather triage a false positive than miss a genuine incident. All submissions are reviewed by our security team.
03

How to report

Send all security reports to our dedicated security inbox. Use the correct subject line prefix so your report routes to the right responder.

Example subject: SECURITY INCIDENT: Suspicious login to my account

What to include in your report

The more detail you provide, the faster we can respond. Include as many of the following as possible:

  • Affected account or service. Your account email or username, and which part of the platform is affected.
  • Description. What happened, when it occurred, and how you discovered it.
  • Reproduction steps. For vulnerabilities — step-by-step instructions to reproduce the issue.
  • Supporting evidence. Screenshots, log extracts, email headers (for phishing), error messages, or network traces.
  • Impact assessment. Any actual or potential consequences — data loss, unauthorised transactions, service disruption.
  • Contact preference. Whether you prefer to be kept updated on progress and at what address.
!
Do not publicly disclose details of unpatched vulnerabilities before coordinating with us. Public disclosure before a fix is available puts all users at risk. We commit to responding within 48 hours and providing a resolution timeline for all valid vulnerability reports.
04

Our response process

Every report follows a structured response workflow to ensure nothing is missed:

Stage What happens Timeframe
Acknowledgement We confirm receipt of your report and assign a case reference Within 4 business hours
Triage Security team assesses severity, scope, and immediate risk Within 24 hours
Containment Affected systems isolated, compromised credentials invalidated As rapidly as safely possible
Investigation Root cause analysis, full scope determination, impact assessment Ongoing · updates every 48 hours
User notification Affected users notified if breach poses risk to their rights (GDPR / CCPA) Within 72 hours of confirmation
Remediation Patch deployed, data restored from backups if required, credentials reset Severity-dependent
Post-mortem Root cause documented, controls updated, reporter credited if applicable Within 14 days of closure
05

Severity classification

We classify incidents using the following severity levels to prioritise response time and resource allocation:

Level Criteria Response SLA
Critical Active breach, data exfiltration, remote code execution, authentication bypass affecting all users Immediate — on-call engineer paged
High Single-account compromise, significant vulnerability with proof of concept, confirmed phishing campaign Within 4 hours
Medium Vulnerability without active exploitation, suspicious activity without confirmed breach Within 24 hours
Low Minor configuration issues, informational findings, unconfirmed anomalies Within 72 hours
06

Confidentiality & non-retaliation

  • Confidentiality. All incident reports are treated as strictly confidential. Access is limited to authorised security personnel directly involved in the investigation. Reports are never shared externally without your consent, except where legally required.
  • Anonymity. You may submit reports anonymously. Anonymous reports receive the same investigation priority as identified reports. If you report anonymously we cannot send progress updates.
  • Non-retaliation. MagicTradeBot strictly prohibits any form of retaliation against individuals who report security concerns in good faith — whether they are users, researchers, employees, or third parties.
  • Good-faith protection. Researchers who follow responsible disclosure practices and do not exceed the scope of testing will not face legal action from MagicTradeBot related to their research activity.
07

Responsible disclosure guidelines

If you have discovered a security vulnerability, we ask that you follow these responsible disclosure principles:

  • Do report findings to sales@magictradebot.com promptly with full technical details
  • Do allow us reasonable time to investigate and remediate before any public disclosure — we aim to patch critical issues within 30 days
  • Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability
  • Do not perform denial-of-service testing, social engineering against staff, or physical security testing
  • Do not publicly disclose vulnerability details before a fix is available and coordinated with our team
i
Researcher recognition. We credit security researchers who report valid vulnerabilities through responsible disclosure in our security acknowledgements page. For significant findings, we may offer additional recognition at our discretion.
08

Regulatory compliance

  • GDPR. Where a security incident constitutes a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under Article 33 of the GDPR.
  • CCPA. We notify affected California residents in the event of a breach involving their personal information, consistent with California Civil Code § 1798.29.
  • User notification. Affected users are notified by email within 72 hours of a confirmed breach that poses risk to their data or rights. Notifications include the nature of the breach, categories of data involved, likely consequences, and remediation steps taken.
  • Law enforcement. We cooperate fully with law enforcement and regulatory authorities when legally required, and will notify affected users to the extent permitted by law.
09

Policy updates

This Incident Reporting policy is reviewed quarterly and updated as necessary to reflect changes in our infrastructure, threat landscape, and regulatory requirements. Material changes will be communicated via email to registered users and displayed as a notice on the platform for 30 days.

10

Contact

For all security incidents, vulnerability disclosures, or related enquiries, contact our security team:

Related: Security Policy Privacy Policy GDPR Compliance Report an incident