Report a security issue

If you find a security issue in Shield, email us the steps to reproduce, what an attacker could do, and the account or URL you tested.

We reply within 3 business days and keep you updated until it's fixed.

How we test our security

Halborn, an independent security firm, assessed Shield's security.
Shield participates in Anthropic's Cyber Verification Program, which gives verified security teams access to Anthropic's most capable models for defensive security work on their own systems.

We pay for issues that put customer funds, accounts or data at risk.

We set the severity and amount based on impact and report quality.
We pay in USD or USDT. Before we pay, we confirm who you are. We can't pay where sanctions or the law don't allow it.
The first person to report an issue gets the reward.

Critical: Up to $1,500For example: moving funds, taking over an account, or reading another customer's balances, transactions or documents.
High: Up to $750For example: bypassing a payment approval or a 2-step check.
Medium: Up to $250For example: exposing limited customer details, such as a name or email, without account access.
Low: No cash rewardLow-severity reports get our thanks and credit, but no cash reward.

Test only on accounts you own. Never access, change or keep another customer's data or funds.
Don't run denial-of-service tests, send spam, or social-engineer our team or customers.
Stop and report as soon as you confirm an issue.
Give us 90 days to fix it before you share it publicly.
If you follow the law and these rules, we treat your testing as authorized and won't take legal action against you. We can't give permission for our partners' or vendors' systems.

Email security@shieldfinancial.com with the details.