Vulnerability Disclosure Policy

1. How to report

Email support@zyndpay.io with the subject Security report. Please write in French or English and include:

• the website, application or API address concerned;
• a description of the issue and its possible impact;
• the steps needed to reproduce it;
• how we can contact you.

Our machine-readable contact details are published at /.well-known/security.txt.

2. Our commitments

• We acknowledge your report within three business days.
• We keep you informed while we investigate and fix the issue.
• We will not take legal action against research carried out in good faith and in line with this policy.
• Once the issue is fixed, we credit you publicly if you wish.

3. Rules for testing

• Test only with accounts you own or are allowed to use.
• Do not access, change or delete other people’s data. If you reach such data, stop and tell us.
• Do not move funds you do not own and do not try to defraud a customer, a merchant or ZyndPay.
• Do not disrupt our services: no denial of service, no high-volume automated scanning, no spam.
• No social engineering of our staff or customers and no physical attacks.
• Give us reasonable time to fix the issue before any public disclosure, and agree the date with us.
• Delete any data you obtained once your report is closed.

Testing outside these rules is not authorised.

4. Out of scope

• automated scanner output without a demonstrated impact;
• missing best-practice settings with no practical security impact;
• volumetric or rate-limiting tests;
• services we do not operate ourselves.

5. Rewards

We do not currently run a paid bug bounty programme. We value every useful report and thank researchers who help protect our customers.