Security

How to report a vulnerability

Send a report to contact@reservebeat.com. A useful report names the page, route or endpoint affected, the steps that reproduce the problem, and what happened against what you expected. For anything under /v1 or /account, quote the request id — error.request_id in a refusal body, or the X-Request-ID header on any response — which names that exact request in the service's own record. Please leave other people's data out of a report.

A report that a figure published here is wrong is not a security report; it follows the correction route set out on Contact

In scope, and out

In scope: this website, the public read API under /v1, the API account routes under /account, and the webhooks the service signs and sends to its customers.

Out of scope: the issuers, their attestation reports and their token contracts, which ReserveBeat reads but does not operate; the outside services named below, which answer for their own systems; denial-of-service testing and high-volume automated scanning; social engineering; and physical attacks. The request limits on /v1 and /account are enforced on purpose, so reaching one is not a finding in itself.

Acknowledgement

A report is acknowledged within five business days. That is a target, not a service-level commitment: the acknowledgement says the report arrived and was logged, not that it was assessed or fixed by that date. No bounty or reward is offered.

Safe harbor

As of 8 October 2026, ReserveBeat has adopted disclose.io's core safe-harbor terms for vulnerability research under this policy. They are set out below exactly as disclose.io publishes them.

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

• Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
• Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
• Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.

These terms are disclose.io's safe-harbor template, taken from github.com/disclose/dioterms (file terms/safe-harbor/en-US.md at commit d1221bdc86c9dc9617571db09147422ac6347fa9), which dedicates it to the public domain under CC0 1.0. ReserveBeat adopted it on 8 October 2026 without changing a word.

If an incident affects your account

If a security incident affects an API account, ReserveBeat writes to the email address on that account. What is disclosed publicly goes on the status page and in the changelog. No notification deadline is promised: there is no service-level agreement.

Status · Changelog