Security reporting
Last updated 4 September 2026
Report a concern
Email security@volapilot.com with the affected page, the time observed, the expected behaviour and steps that reproduce the issue. Remove passwords, one-time codes, Deriv tokens and unnecessary personal or financial information.
Good-faith testing
Use only accounts and information you own or are expressly authorized to test. Stop immediately if you encounter another person's data. Do not access, alter, retain or publish that data; include only the minimum evidence needed for us to investigate.
Out of scope
Do not use social engineering, phishing, denial-of-service traffic, physical attacks, malware, automated high-volume scanning or tests that interrupt trading or upstream providers. Do not attempt to move funds, place unauthorized contracts or test Deriv systems through VolaPilot.
What happens next
We will acknowledge a useful report, preserve relevant evidence, assess impact and coordinate remediation. We may ask for a secure way to receive additional technical detail. We will not promise a reward unless a written programme says otherwise.
Security boundaries
VolaPilot never asks for a Deriv password, one-time code or account token through email, Telegram or support. Deriv authentication should occur only on Deriv's own consent page. A requested order is not treated as accepted until Deriv confirms it.