Vulnerability disclosure policy
At Payabli, the security of our platform, customers, and partners is a top priority. We value the security community and encourage responsible disclosure of potential vulnerabilities in our systems.
This policy outlines how to report security issues to Payabli and what you can expect from us in return.
Our commitment
If you identify a security vulnerability and report it to us in accordance with this policy, Payabli commits to:
- Acknowledge receipt of your report within a reasonable timeframe
- Investigate the issue promptly
- Work to remediate validated vulnerabilities based on severity and risk
- Not pursue legal action for good faith security research conducted in accordance with this policy
We appreciate responsible disclosure and collaboration that helps improve our security posture.
Scope
This policy applies to vulnerabilities in:
- Publicly accessible Payabli websites
- Public APIs and developer endpoints
- Applications and services owned and operated by Payabli
Out of scope
The following aren’t covered by this policy:
- Third-party vendors, partners, or integrations not owned by Payabli
- Social engineering, phishing, or physical testing of employees
- Denial of service (DoS/DDoS) testing
- Automated scanning that degrades performance
- Any testing that violates applicable law
If you aren’t sure whether a system is in scope, contact us before proceeding.
How to report a vulnerability
Submit vulnerability reports to vulnerability@payabli.com.
To help us triage quickly, include:
- A detailed description of the issue
- Affected URL, endpoint, or system
- Steps to reproduce
- Proof of concept (screenshots, request/response samples, etc.)
- Any potential impact you identified
- Your contact information
We request that you refrain from public disclosure until we’ve had a reasonable opportunity to investigate and remediate.
Responsible disclosure guidelines
We ask that you:
- Act in good faith
- Avoid accessing, modifying, or exfiltrating customer data
- Limit testing to what’s necessary to demonstrate the vulnerability
- Cease testing immediately if sensitive data is encountered and notify us
- Don’t attempt privilege escalation, persistence, or lateral movement
Testing that causes service disruption or operational impact isn’t authorized.
Safe harbor
If you conduct research in good faith and in accordance with this policy, Payabli won’t pursue legal action related to your findings.
This safe harbor applies only to activities that comply with this policy and applicable laws.
Rewards and recognition
Payabli doesn’t operate a formal bug bounty program.
We may, at our sole discretion:
- Provide public recognition (with your permission)
- Offer non-monetary acknowledgment
- Provide discretionary compensation
Submission of a report doesn’t create an entitlement to compensation. Any reward or payout is determined solely at Payabli’s discretion.
Policy changes
Payabli reserves the right to modify or terminate this vulnerability disclosure policy at any time.
