Sensible Reporting Policy

Our Commitment to Security

QuantConnect Corporation (“QuantConnect”, “we”, “us”, “our”) builds the infrastructure that quants use to research, backtest, and live trade their strategies. Our members trust us with their algorithms, their brokerage connections, and their data, and we take the security of that trust seriously. We value the work of the security research community and believe that coordinated, sensible reporting of vulnerabilities is one of the most effective ways to keep our members safe.

This Sensible Reporting Policy (the “Policy”) describes how to report a suspected security vulnerability in QuantConnect systems, what you can expect from us in return, the rules you must follow while researching, and how we recognize and reward researchers who help us. It is our responsible disclosure program and is consistent with the practices recommended by ISO/IEC 29147, ISO/IEC 30111, and the disclose.io safe harbor framework.

By participating in this program you agree to the terms of this Policy. Use of QuantConnect services remains subject to our Terms and Conditions and Privacy Policy.

1.0 Scope

• 1.1 In Scope

  The following systems and services owned and operated by QuantConnect are in scope for this Policy:

  (a) The website and web application at https://www.quantconnect.com and its subdomains;

  (b) The QuantConnect REST API at https://www.quantconnect.com/api/ and the QuantConnect MCP server;

  (c) QuantConnect Cloud research, backtesting, optimization, and live trading infrastructure, including the Object Store and the Datasets Market;

  (d) The Lean CLI, Lean Docker images, and the LEAN engine source code published at https://github.com/QuantConnect;

  (e) Official QuantConnect mobile applications and browser extensions, where available.

• 1.2 Out of Scope

  The following are not in scope for this Policy. Reports about them will be accepted and forwarded where appropriate, but they are not eligible for a bounty and you are not authorized to test them under this Policy:

  (a) Systems operated by third parties, including brokerages, data vendors, payment processors, cloud hosting providers, email providers, and community platforms such as Discord, GitHub, or Printify. Please report issues with those systems to the respective provider;

  (b) Vulnerabilities in third-party libraries or dependencies that have already been publicly disclosed, unless you can demonstrate a specific, exploitable impact on QuantConnect systems;

  (c) Social engineering, phishing, or physical attacks against QuantConnect employees, contractors, members, offices, or facilities;

  (d) Denial of service, resource exhaustion, brute force, or load testing of any kind;

  (e) Algorithms, projects, and content created by other members of the QuantConnect community;

  (f) Trading losses, market data inaccuracies, or backtest results. These are support matters and should be reported to support@quantconnect.com.

2.0 Research Guidelines

We authorize security research against in-scope systems only when it is performed in accordance with the following guidelines. These guidelines exist to protect our members, our platform, and you.

• 2.1 Non-Destructive Research

  All research must be conducted in a non-destructive manner. You must not modify, delete, corrupt, encrypt, or otherwise interfere with data, systems, services, or accounts that do not belong to you. You must not degrade the availability or performance of any QuantConnect service, and you must not interfere with live trading, order routing, or brokerage connectivity under any circumstances. If an action could affect another member or the integrity of the platform, do not take it.

• 2.2 Report Immediately and Stop

  Reports must be filed as soon as a vulnerability is known. Once you have enough evidence to show that an issue exists, stop testing and submit your report. Do not conduct further probing or research to determine the full extent of the issue, chain it with other vulnerabilities, escalate privileges, move laterally to other systems, establish persistence, or otherwise demonstrate a wider impact. We will perform that assessment ourselves and will credit you for the full severity we determine.

• 2.3 Test Only Against Your Own Accounts

  Only test against accounts, projects, organizations, and data that you own or that you have been explicitly authorized by the owner to test. Create dedicated test accounts for your research and identify them where possible by including the word “security” in the account name or organization name. Do not access, attempt to access, or interact with any account or data that belongs to another member.

• 2.4 No Data Exfiltration

  If you encounter data belonging to QuantConnect or any of its members, including personal information, credentials, API tokens, brokerage details, financial data, source code, or licensed market data, you must stop immediately, must not download, copy, store, or share that data beyond the minimum needed to demonstrate the vulnerability in your report, and must securely delete any such data as soon as the report is acknowledged. Licensed market data may not be exported from the platform under any circumstances, including as part of a proof of concept.

• 2.5 Prohibited Techniques

  The following techniques are never authorized under this Policy: denial of service or resource exhaustion; automated scanning at a rate that could impair service; brute force attacks against authentication, rate limits, or secrets; social engineering of any kind; physical attacks; spam or unsolicited messages to members; installing malware or backdoors; and any attack that targets QuantConnect employees, contractors, or members directly.

• 2.6 Confidentiality and Disclosure

  All details of a vulnerability, your report, and any related correspondence with QuantConnect are confidential. You may not publish, present, or otherwise disclose any details of a vulnerability, including its existence, to any third party without QuantConnect's prior written approval. This restriction applies before and after remediation and has no expiry. If you would like to write about an issue after it has been remediated, send us your request and a draft, and we will review it in good faith; approval is at our sole discretion and may be conditioned on the removal of specific details. Submitting a report does not grant you any right to publish it.

• 2.7 No Extortion

  Do not condition the reporting of a vulnerability, or compliance with Section 2.6, on payment or any other demand. Rewards are determined solely by the process in Section 5.

• 2.8 Comply with Law

  You must comply with all applicable laws and regulations in connection with your research. You must not use this Policy as cover for activity that would be unlawful irrespective of this Policy, such as accessing systems that are out of scope or research performed on behalf of a sanctioned person or jurisdiction.

3.0 Safe Harbor

• 3.1 Authorization

  When you conduct security research in good faith and in accordance with this Policy, we consider that research to be authorized. We will not pursue or support civil action or criminal complaints against you under the Computer Fraud and Abuse Act (CFAA), the Digital Millennium Copyright Act (DMCA), or comparable state, federal, or foreign laws for research conducted in accordance with this Policy, and we will not pursue claims under our Terms and Conditions for actions that were necessary to comply with this Policy. To the extent your research involves circumvention of technological measures, we waive any DMCA claim against you for that circumvention when it is performed in accordance with this Policy.

• 3.2 Third Parties

  This authorization extends only to QuantConnect systems. We cannot authorize research against systems owned by third parties, and this Policy does not bind third parties or law enforcement. If legal action is initiated by a third party against you in connection with research conducted in accordance with this Policy, we will make it known that your actions were authorized by us.

• 3.3 Good Faith

  Safe harbor applies only to research performed in good faith. Research that violates this Policy, that is conducted with intent to cause harm, that exfiltrates or misuses data, that extorts, or that is otherwise not in good faith is not authorized and is not protected. If at any point you are unsure whether your research is consistent with this Policy, stop and contact us at security@quantconnect.com before continuing.

4.0 How to Report

• 4.1 Where to Send Reports

  Send reports by email to security@quantconnect.com. Our contact details are also published in machine-readable form at /.well-known/security.txt in accordance with RFC 9116. Please do not report vulnerabilities through public channels such as the community forum, GitHub issues, Discord, or social media, and please do not report them to support or sales staff.

• 4.2 What to Include

  A good report lets us reproduce and fix the issue quickly. Please include, where you have it:

  (a) A short description of the vulnerability and its potential impact;

  (b) The affected URL, endpoint, product, or component, and the version if applicable;

  (c) Clear step-by-step instructions to reproduce the issue, with any requests, responses, screenshots, or minimal proof-of-concept code;

  (d) The account or organization identifiers you used for testing;

  (e) The date and approximate time of your testing, so we can correlate it with our logs;

  (f) Whether you would prefer to remain anonymous in our internal records.

  Please send one vulnerability per report unless the issues must be chained to demonstrate impact. Reports may be submitted in English.

• 4.3 Sensitive Material

  Do not include personal information, credentials, or licensed data belonging to other members in your report. If demonstrating the issue requires such material, describe it rather than including it, and tell us so that we can retrieve it from our own systems.

• 4.4 What You Can Expect From Us

  When you submit a report in accordance with this Policy we will:

  (a) Acknowledge receipt of your report within three (3) business days;

  (b) Triage the report, confirm whether we can reproduce the issue, and assign an initial severity within ten (10) business days;

  (c) Keep you informed of our progress at reasonable intervals and respond to your questions;

  (d) Work to remediate confirmed vulnerabilities as quickly as possible, with a target of ninety (90) days from acknowledgement for most issues, and notify you when the fix is deployed;

  (e) Handle your report and your identity with confidentiality and share them only with those who need to know in order to remediate the issue;

  (f) Recognize your contribution as described in Section 5.

5.0 Recognition and Bounties

• 5.1 Discretionary Rewards

  We may, at our sole discretion, award a monetary bounty, swag, or private recognition for reports that identify a genuine, previously unknown security vulnerability in an in-scope system and that are submitted in accordance with this Policy. The amount of any bounty is determined by QuantConnect based on the severity of the issue, assessed with reference to the Common Vulnerability Scoring System (CVSS), the quality and clarity of the report, and the realistic impact on QuantConnect and its members. QuantConnect’s determination of severity and reward is final.

• 5.2 Repeat and Previously Known Reports

  Repeat or previously known reports are ineligible for a bounty. Only the first reporter of a given vulnerability is eligible. A report is considered a duplicate if the underlying issue was previously reported by another researcher, was already known to QuantConnect through internal testing, monitoring, audits, or any other source, or is a variation of an issue that we are already in the process of remediating. We will tell you if your report is a duplicate. Reports of the same root cause across multiple endpoints, parameters, or hosts are treated as a single report.

• 5.3 Eligibility Requirements

  To be eligible for a bounty you must:

  (a) Be the first person to report the vulnerability;

  (b) Have complied with every provision of this Policy, including the research guidelines in Section 2;

  (c) Not be a current or former employee or contractor of QuantConnect, or an immediate family member or household member of one, and not have been involved in the development of the affected component;

  (d) Not be a resident of, or located in, a country or territory subject to United States sanctions, and not be a person with whom United States persons are prohibited from doing business;

  (e) Be at least 18 years of age, or have the consent of a parent or guardian, and be legally able to receive the reward in your jurisdiction;

  (f) Provide any information we reasonably require to process payment and comply with tax and legal obligations.

• 5.4 Ineligible Findings

  The following categories of findings are generally considered informational or low impact and are not eligible for a bounty unless you can demonstrate a concrete, exploitable security impact:

  (a) Reports from automated scanners or tools without a demonstrated, validated vulnerability;

  (b) Missing or misconfigured security headers, cookie flags, or TLS configurations without a demonstrated exploit;

  (c) Clickjacking on pages with no sensitive actions, self-XSS, or issues that require an unlikely level of user interaction;

  (d) Cross-site request forgery on unauthenticated forms or forms with no sensitive effect, including logout;

  (e) Missing rate limiting, account or email enumeration, or password policy complaints;

  (f) Software version disclosure, banner identification, stack traces, or verbose error messages without a demonstrated exploit;

  (g) Email configuration issues such as SPF, DKIM, or DMARC records;

  (h) Open redirects, unless chained to demonstrate a higher impact;

  (i) Issues that require a compromised, rooted, or jailbroken device, physical access to a device, or a man-in-the-middle position;

  (j) Vulnerabilities in outdated or unsupported browsers, operating systems, or client software;

  (k) Theoretical vulnerabilities, best-practice recommendations, or findings without a practical attack scenario;

  (l) Vulnerabilities that only affect out-of-scope systems listed in Section 1.2;

  (m) Content spoofing or text injection without an attack vector;

  (n) Issues in the LEAN open source engine that only affect a user running it locally against their own data and that do not affect QuantConnect Cloud.

• 5.5 Recognition

  Recognition for a confirmed vulnerability is private unless both you and QuantConnect agree otherwise in writing.

• 5.6 Payment

  Bounties are paid after the vulnerability has been confirmed and, in most cases, after it has been remediated. You are responsible for any taxes due on a reward. We may be unable to pay a bounty where payment would violate applicable law, including sanctions and export control laws.

6.0 General

• 6.1 Changes to This Policy

  We may update this Policy from time to time. The version and date at the top of this page indicate when it was last changed. Research performed in accordance with the version of this Policy in effect at the time of the research is covered by its safe harbor provisions.

• 6.2 Relationship to Other Agreements

  This Policy supplements, and does not replace, our Terms and Conditions, Privacy Policy, and any other agreement between you and QuantConnect. Where this Policy expressly authorizes conduct that would otherwise be prohibited by those agreements, this Policy controls for research performed in accordance with it. This Policy does not create any employment, agency, partnership, or contractual obligation on QuantConnect to pay a bounty.

• 6.3 Members Reporting Account Compromise

  If you are a QuantConnect member and believe that your own account has been compromised, change your password, revoke your API tokens, and contact support@quantconnect.com immediately. Account compromise is handled by support rather than under this Policy, unless it is the result of a platform vulnerability.

• 6.4 Contact Information

  Reports and questions about this Policy should be sent to our Product Security Team:
  
  Gustavo Aviles
  Product Security Team Lead
  linkedin.com/in/gustavoaviles
  Email: security@quantconnect.com
  
  QuantConnect Corporation
  150 S Pine Island Rd, Suite 300
  Plantation, FL 33324