Mantle

Security Policy

Last updated 2 July 2026

Scope

This policy covers mantleadvise.com and all subdomains operated by Square Peg Financial Pty Ltd (ABN 37 551 147 233) in connection with the Mantle platform.

Reporting a vulnerability

If you believe you've found a security issue, please email [email protected] with a clear description, steps to reproduce, and any relevant logs or screenshots. Encrypted email is welcome — request a PGP key in your first message if you'd like to use one.

We aim to acknowledge reports within two business days and to provide a remediation timeline within five business days for confirmed issues.

Safe harbour

Security research conducted in accordance with this policy is authorised. We will not pursue legal action against researchers who:

  • Act in good faith and avoid privacy violations, service degradation, or disruption to other users;
  • Report the issue promptly and do not disclose it publicly before remediation;
  • Do not access, modify, or exfiltrate any data belonging to clients or the firm beyond what is minimally necessary to demonstrate the vulnerability;
  • Do not perform destructive testing, denial-of-service, social engineering of staff, or physical intrusion.

Out of scope

The following are not eligible for report and will not receive a response:

  • Missing security headers on non-sensitive endpoints;
  • Reports produced solely by automated scanners without a demonstrable impact;
  • Rate-limiting or brute-force issues on public endpoints without a working proof of concept;
  • Social engineering, phishing of staff or clients, or physical attacks;
  • Vulnerabilities in third-party services that we do not operate (e.g. Google, Anthropic, Cloudflare, Supabase, Resend);
  • Findings in the DigitalOcean origin URL (seashell-app-j9csy.ondigitalocean.app) that are already addressed on the canonical mantleadvise.com domain.

Coordinated disclosure

We ask that reporters give us a reasonable window to remediate before public disclosure — typically 90 days from acknowledgement, or sooner if the issue is already remediated. We're happy to credit researchers publicly with permission.