Security disclosure policy
This policy sets out how to report a security vulnerability affecting the Stablecoin Freeze & Seize Tracker and the services served with it, what we do when you report one, and the terms under which good-faith security research is authorized. It is part of our terms of use, and a machine-readable copy is served at /.well-known/security.txt.
As of 17 August 2026.
1. Scope
This policy covers the public web properties, APIs, and services that Eagle Virtual LLC ("Eagle Virtual", "we", "us") operates directly: eaglevirtual.com and the application routes beneath it, the API, the MCP server, and the account features. Third-party services, infrastructure we do not operate, and customer-controlled environments are out of scope unless we confirm otherwise in writing during triage.
2. How to report a vulnerability
Email legal@eaglevirtual.com with enough detail for us to reproduce and validate the issue. A useful report includes: a short summary and the affected URL or endpoint; clear reproduction steps, with sample requests where relevant; your assessment of the impact and the conditions required to exploit it; any screenshots, logs, or proof-of-concept material needed to verify the finding; and your preferred contact details for follow-up.
If a report contains personal data or secrets that you encountered while testing, include only what is needed to demonstrate the issue and tell us what you hold, so that we can arrange its deletion.
3. What happens next, and how long it takes
We review good-faith reports promptly and keep reporters informed during triage and remediation.
| Item | Detail |
|---|---|
| 3 business days | Target for the initial acknowledgment of a new report. |
| 7 business days | Target for an initial validation status, or a follow-up request for more detail. |
| Remediation | We ask reporters to coordinate disclosure with us until a fix or mitigation is in place, and we tell you when it is. |
4. Authorized research
We support security research intended to improve the safety of the Service. Testing that is limited to what is necessary to confirm a vulnerability, and that avoids harm, privacy violations, and service disruption, is authorized under this policy. Research conducted in accordance with this policy is considered authorized, and we will not pursue or support legal action against you for it. If a third party takes action against you for research that complied with this policy, we will make that compliance known.
You agree to: stop testing once you have confirmed the issue; report it promptly and keep the details confidential while we remediate; and use only accounts, wallets, and data that you own or are explicitly authorized to test.
You agree not to: access, alter, retain, or exfiltrate data belonging to other users; perform denial-of-service, spam, social-engineering, phishing, or physical attacks; attempt persistence, privilege escalation, or lateral movement beyond what is required to demonstrate the issue; or publicly disclose an issue before we have had a reasonable opportunity to remediate it.
5. Coordinated disclosure
Please give us a reasonable opportunity to investigate and remediate a verified issue before any public disclosure. Once an issue is remediated, you are free to publish your findings; if you would like public acknowledgment, say so in your report and we will do our best to accommodate it. Eagle Virtual does not currently run a public bug bounty, and does not offer payment for reports; valid reports are reviewed and acted on.
6. How we protect the Service
The measures we apply are described in our privacy policy at /privacy and, for customers, in the data processing agreement at /dpa: encryption in transit on every public endpoint, session tokens stored only in hashed form, access limited to the people and systems that need it, a design that collects nothing it does not use, and the platform protections of the provider that hosts and fronts the Service. No method of transmission or storage is perfectly secure, which is why this policy exists.
7. Who we are and how to contact us
Eagle Virtual LLC, a Florida limited liability company, 8586 Potter Park Dr, Sarasota, FL 34238, United States. Security reports and legal matters: legal@eaglevirtual.com. Other contact routes are published at /contact.