Security & Responsible Disclosure

Security reports are welcome at security@diecastmarkets.com. Please include the affected URL or feature, steps to reproduce, the impact you observed, and enough detail for us to investigate without including unnecessary personal information.

Security practices

• Payment card details are handled by Stripe and are not stored by Diecast Markets.
• Marketplace data access uses server-side authorization and database row-level security.
• Sensitive tax identifiers and dates of birth are encrypted before database storage.
• Administrative and sensitive account workflows are designed for least-privilege access and step-up authentication.
• Security-sensitive changes are reviewed, tested and scanned before production release.
• Security and audit events are retained where needed for fraud prevention, investigation and legal obligations.

Responsible testing

Do not access or change another person's data, perform denial-of-service or traffic flooding, use social engineering, send malware, or continue testing after you have enough evidence to demonstrate a vulnerability. Use test data where possible. If you encounter personal information, stop and report it rather than copying or retaining it.

What to expect

We review good-faith vulnerability reports, preserve relevant evidence, prioritize issues by risk, and rotate or revoke credentials when an incident requires it. We may ask for more information while reproducing a report. This page is not a bug-bounty promise and does not authorize testing that would violate law or another person's rights.

Account compromise or privacy incident

If the issue is an account takeover, suspected data exposure, or another urgent security incident, put that in the subject line so it can be triaged appropriately. Privacy requests should continue to use the Privacy Officer contact listed in the Privacy Policy.