Security & vulnerability disclosure

We take the security of payed.me and of our users' data seriously. If you believe you have found a vulnerability, we want to hear about it.

How to report

Email support@payed.me with "Security" in the subject. Please include:

• the affected URL or feature;
• clear steps to reproduce the issue;
• what an attacker could actually achieve, with evidence.

We aim to acknowledge valid reports within 5 working days and will keep you informed while we fix them.

Rules for good-faith research

• Only test against accounts you own or have permission to use.
• Do not access, change or delete other users' data. If you reach it by accident, stop and tell us.
• Do not run denial-of-service, spam or social-engineering attacks, and do not test physical security.
• Give us reasonable time to fix an issue before you disclose it publicly.

If you follow these rules, we will not take legal action against you for your research.

Bug bounty

We do not run a paid bug bounty program and do not pay for unsolicited reports.We are grateful for responsible disclosure, but payment requests, or holding back details until payment is agreed, will not change how we handle a report.

Out of scope

We do not treat the following as vulnerabilities on their own:

• reports from automated scanners with no demonstrated, exploitable impact;
• clickjacking on pages without a sensitive action, or missing headers that are best practice;
• email configuration (SPF, DKIM, DMARC) and email spoofing;
• issues that require a compromised device, physical access, or an out-of-date browser;
• rate limiting or brute force on non-authentication endpoints;
• software version disclosure or descriptive error messages;
• vulnerabilities in third-party services we use, such as Stripe.