Skip to main content

Security Policy

Protecting our clients and their data is our top priority

Our Commitment

At Skyie Global Finance, we take the security of our systems and client data very seriously. We appreciate the efforts of security researchers and the broader community in helping us maintain the highest security standards.

This policy outlines our guidelines for responsible disclosure of security vulnerabilities and our commitment to working with researchers to resolve issues quickly and responsibly.

Reporting a Vulnerability

If you discover a security vulnerability, please report it to us as soon as possible by emailing:

[email protected]

Alternatively: [email protected]

What to Include in Your Report:

  • Detailed description of the vulnerability
  • Steps to reproduce the issue
  • Potential impact and affected systems
  • Any proof-of-concept code (if applicable)
  • Your contact information for follow-up

Our Response Process

48 hours
Initial acknowledgment of your report
7 days
Initial assessment and validation of the vulnerability
30 days
Target resolution for critical vulnerabilities
90 days
Target resolution for non-critical vulnerabilities

Scope

In Scope

  • • finance.skyieglobal.com
  • • www.skyieglobal.com
  • • skyieglobal.co.uk
  • • Authentication and authorization issues
  • • Data exposure vulnerabilities
  • • Injection vulnerabilities (SQL, XSS, etc.)

Out of Scope

  • • Denial of Service (DoS/DDoS) attacks
  • • Social engineering attacks
  • • Physical security issues
  • • Third-party services
  • • Spam or email configuration issues
  • • Reports from automated tools without validation

Safe Harbor

Skyie Global Finance supports safe harbor for security researchers who:

  • Make a good faith effort to avoid privacy violations, data destruction, and service disruption
  • Report vulnerabilities promptly
  • Provide reasonable time for remediation before public disclosure (we recommend 90 days)
  • Do not exploit vulnerabilities beyond what is necessary to demonstrate risk

We will not pursue legal action against researchers who follow these guidelines.

Our Security Measures

Authentication

Iron-session with AES-256-GCM encryption, bcrypt password hashing with 12 rounds

Rate Limiting

Comprehensive rate limiting on all sensitive endpoints to prevent brute force attacks

CSRF Protection

Double-submit cookie pattern with timing-safe token comparison

Input Validation

All user input is validated, sanitized, and escaped to prevent injection attacks

Security Headers

HSTS, CSP, X-Frame-Options, and other security headers configured

Regular Updates

Dependencies are regularly audited and updated to address known vulnerabilities

Questions?

If you have questions about this security policy, please contact us:

Email: [email protected]

Last updated: 19 July 2026