Only the latest published BreakTwenty release receives security fixes.

Older releases, prereleases, development branches, arbitrary source snapshots, and locally modified builds are not supported unless explicitly stated otherwise.

Security fixes are provided only through new BreakTwenty releases. Older releases do not receive separate patches or backported fixes.

If you find a suspected security vulnerability in BreakTwenty, please report it privately through either:

• GitHub Private Vulnerability Reporting for the BreakTwenty repository; or
• security@breaktwenty.com

You do not need to open a public GitHub Issue or Discussion to report a security problem.

Please do not publicly disclose a suspected vulnerability before it has been investigated.

BreakTwenty does not automatically upload financial data, authentication material, or diagnostics to the developer. A security report contains only the information you intentionally submit, so review and sanitize every attachment before sending it.

Do not:

• open a public GitHub Issue or Discussion containing vulnerability details;
• submit a public pull request containing exploitation details;
• publicly post credentials, tokens, cookies, authentication or session artifacts, private diagnostics, or other security-sensitive data.

When reporting an issue, include whatever is useful for reproducing it, such as:

• the affected BreakTwenty version or commit;
• operating system;
• installation or runtime mode;
• reproduction steps;
• observed or potential impact; and
• relevant sanitized diagnostics.

Do not send real:

• passwords or other credentials;
• one-time passwords;
• authorization headers;
• cookies;
• access or refresh tokens;
• names or other personal information;
• account numbers;
• balances or transaction values;
• raw BreakTwenty databases;
• unsanitized provider captures; or
• another person's private data.

Only test BreakTwenty using systems, accounts, and data that you own or are explicitly authorized to use.

Do not access, modify, retain, or disclose another person's data.

Do not intentionally damage or destroy data.

Do not perform denial-of-service testing, social engineering, credential attacks, or other testing that could harm users or third parties.

This policy does not authorize security testing against banks, brokerages, exchanges, market-data providers, or any other third-party service that BreakTwenty connects to or uses.

Keep testing limited to what is reasonably necessary to confirm the suspected BreakTwenty issue.

Please report the problem privately and allow reasonable time for it to be investigated and, where appropriate, fixed before publishing technical details.

Security reports will be reviewed and assessed.

BreakTwenty is currently maintained by an independent developer, so no fixed response or remediation time is guaranteed.

BreakTwenty does not currently offer:

• a bug bounty;
• payment or rewards for vulnerability reports;
• a guaranteed response time;
• a guaranteed remediation date; or
• special legal authorization for security testing.

This document explains how to report security issues and which BreakTwenty releases receive security fixes.

It does not grant additional rights to use, modify, test, or distribute BreakTwenty and does not replace or expand the permissions granted by LICENSE.md.