Security Policy

Effective: October 28, 2026

Our Commitment

Apipay values the work of security researchers who help us find and fix vulnerabilities responsibly. We accept vulnerability reports covering the properties listed in the Scope section below.

No Monetary Rewards

Apipay does not currently run a bug bounty program and does not offer monetary or credit rewards for vulnerability reports. We still read and act on every valid report, and may offer public acknowledgment (with your consent) for your contribution.

How to Report

Send your report to security@apipay.id. Please include:

  • a description of the vulnerability
  • steps to reproduce it
  • its potential impact
  • the affected URL or API endpoint

For sensitive information, you can encrypt your email using our public PGP key at apipay.id/.well-known/pgp-key.txt.

Scope

In scope:

Out of scope:

  • infrastructure owned by our payment service provider (PSP) partners or other third parties
  • social engineering (phishing, vishing) against our staff or users
  • physical attacks
  • spam
  • denial-of-service (DoS/DDoS) testing

Testing Guidelines

While testing, please:

  • only access the data needed to demonstrate a vulnerability, without accessing, modifying, or deleting other users’ data beyond what’s necessary
  • avoid testing that could disrupt the Service’s availability for other users
  • avoid publicly disclosing a vulnerability before we confirm a fix
  • give us reasonable time to respond before any public disclosure

Safe Harbor

Apipay will not pursue legal action against researchers who test in good faith and follow this policy. If a third party initiates legal action over activity that complies with this policy, we will state that the activity was authorized by us.

Contact

Vulnerability reports can be sent to security@apipay.id.

Contact our legal team