Vulnerability disclosure policy

Steadi Pay Ltd welcomes reports from security researchers and the public. If you think you have found a vulnerability, a privacy problem or exposed data in anything we run, we want to hear from you. This policy says how to report it, what we ask of you and what you can expect from us.

Where to report

Email security@steadipay.ltd with what you found and how to reproduce it. The more detail you give, the faster we can fix it. Please use this address only, and not public channels, to discuss the issue.

In scope

• steadipay.ltd, www.steadipay.ltd, app.steadipay.ltd, pay.steadipay.ltd, api.steadipay.ltd, docs.steadipay.ltd and status.steadipay.ltd
• The sandbox (pay-sandbox and api-sandbox), which is the best place to test

Out of scope

• Systems we do not own or operate, such as payment providers, mobile money networks, banks and our hosting and email suppliers. Please report those to the owner.
• Denial of service, spam, social engineering and physical attacks

What we ask of you

• Follow this policy and test only the systems in scope.
• Use your own test accounts, or accounts whose owner has agreed, and never real merchants or their customers.
• Do not violate anyone's privacy, disrupt our systems, destroy data or harm the experience of other users.
• If you reach data that is not yours, take the least needed to show the problem, stop testing and report straight away. This includes personal information, card data and anything confidential.
• Report promptly, and give us at least 90 days from your report to fix the issue before you tell anyone else.
• Do not ask for payment in return for keeping quiet.

What you can expect

• A reply within three working days.
• Updates as we confirm and fix the issue, and a fix in good time within what a small team can do.
• With your permission, public thanks once the fix is out.
• Safe harbor for research that follows this policy.

Safe harbor

We consider research done under this policy to be:

• Authorized under any anti-hacking laws that apply, and we will not start or support legal action against you for accidental, good faith breaches of this policy.
• Authorized under any anti-circumvention laws, and we will not bring a claim against you for getting around technical controls.
• Exempt from the parts of our terms of service that would stop you doing security research, which we waive on a limited basis.
• Lawful, helpful and done in good faith.

You must still follow every law that applies to you. If someone else takes legal action against you for research that followed this policy, we will say that your work was done in line with it. If you are unsure whether something is allowed, ask us at the address above before you go further.

Safe harbor covers only legal claims that Steadi Pay Ltd controls. It does not bind other people or companies.

Machine-readable contact details are in our security.txt. Policy text based on the disclose.io open standard.

See also our trust and security overview.