Security Disclosure Policy

Payroc greatly appreciates investigative work into security vulnerabilities that well-intentioned, ethical security researchers carry out. We are committed to thoroughly investigating and resolving security issues in our platform and services in collaboration with the security community. This policy defines how Payroc can work with the security research community to improve our online security.

Please note that Payroc currently does not provide rewards/bounties.

We follow the practice of responsible disclosure to best protect Payroc's partners and customers from the impact of security issues. On our side, this means:

• We will respond to security incidents as a priority.
• We will address the matter as soon as it is practical, keeping in mind that not all risks are created equal.
• We will always transparently let the community know about any incident that affects them.

If you have found a security vulnerability within the Payroc ecosystem, we ask that you disclose it responsibly by emailing [email protected] Optionally, if you want to encrypt your email, you can use our PGP key – see the end of this document. Please do not discuss potential vulnerabilities in public without validating with us first.

On receipt, our security team will:

• Review the report, verify the vulnerability and respond with confirmation and further information requests; we typically reply within 24 hours.
• Once the reported security bug is addressed, we will notify the Researcher, who is welcome to disclose it publicly.

The following is a list of known issues and things we do not consider to be an issue. Please do not send reports regarding the following:

• Account squatting by preventing users from registering with specific email addresses
• Attacks requiring MITM or physical access to a user's device
• Best practice reports without a valid exploit (for example, use of "weak" TLS ciphers)
• Clickjacking on pages with no sensitive actions
• Comma Separated Values (CSV) injection without demonstrating a vulnerability
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Denial of service
• Disclosure of server or software version numbers
• Hypothetical subdomain takeovers without supporting evidence
• Issues that require unlikely user interaction
• Missing best practices in Content Security Policy
• Missing best practices in SSL/TLS configuration
• Missing email best practices (invalid, incomplete, or missing SPF/DKIM/DMARC records, and so on)
• Missing HttpOnly or Secure flags on cookies
• Open redirect - unless an additional security impact can be demonstrated
• Perceived security weaknesses without concrete evidence of the ability to compromise a user (for example, missing rate limits, missing headers, and so on)
• Previously known vulnerable libraries without a working Proof-of-Concept
• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis
• Rate limiting or brute force issues on non-authentication endpoints
• Reports exploiting the behavior of, or vulnerabilities in, outdated browsers
• Reports of spam
• Self-XSS
• Session invalidation or other improved security related to account management when a credential is already known (for example, password reset link does not immediately expire, adding MFA does not expire other sessions, and so on)
• Social engineering
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (for example, stack traces, application or server errors)
• Tabnabbing
• Unconfirmed reports from automated vulnerability scanners
• User/merchant enumeration
• Vulnerabilities only affecting users of outdated or unpatched browsers (less than two stable versions behind the latest released stable version)

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGNBGKWBX4BDADhtCOq8nqsTDkwO1SKzRt/KV5VdQk2j0dMl2mriw0HJctXlUR8 UCbfnUZGjKFVikkUH6F1J9ihy7IubnAGchSnfdNhB+gH0ysAt9yYv/aQ7S1AaU2Z yCuHZsqG7mc66fpt4Qc85iqx/YlkP7pLBAegpFyFt1sjt+6aMHF/dwaOXTWysU3x D0aLhYNqb6Ltk69nAMbmoJtsHrIcA3MFV8bx3JCuLU5ZGlF6426t/l7S4pMl0eLL sSVa13HaN4pkeRMX/2ip5aHF6QAu8XcMBtoaNXoKC+TtLB1mQdrNwbhj4NjGq51q XFb+8o3s/jctB/4M0R1T4Z7Z87CHMYxpRYBURpqXuQcPuTXhsfugmZfJq0pRnNFe +o4IYEpLBYSAMgDu1iCczCcYMQxjhPhKWL6fQPWo6/RdMbgSDppEoGxGCJLUJAYV 82hCp4H+5quAQXtCcPzVp2ktMNEI/PSj1udA95abvIwmWm62husgiV3XlMmR/NUX A/dvhm7vUelgbCsAEQEAAbQcUGF5cm9jIDxzZWN1cml0eUBwYXlyb2MuY29tPokB 0QQTAQgAOxYhBM8Wge79onuWC7DOfpxM7lcFs2FyBQJilgV+AhsDBQsJCAcCAiIC BhUKCQgLAgQWAgMBAh4HAheAAAoJEJxM7lcFs2FyUfwMAKDN+lAi5HU0WepZJca+ ahBnliTSaY8mp4AXhUgW7O16qdINVCNUP1xgFBAB6j6ISmkJRKS/PG7FdVkGNZgH +euMWGUZycsHmj/NEyQWpnQ+5CKcWDD9+OIrT1MSAhjSfJgpf3AUpxychfmi76gM 2Oc5fI8TYDayEkOZ4pj9cMgeuuSK5wJ4T6pf8coCwJxCB39/0lkG9FpcpEpWc3ar PwnKf5EMrUwlWAtUr4xam6hJCZSZdDZbvVxsxjprwtV2HPkBhVRtGZzTP0aB0neC uFix0M5w3KGwodQ1pj9ZNLDRYxx4qDYWh1xpvaMV4ugtm0Hz0jhYnymETCSGvi5r l0jd2Goz9hRMjfoBcfFO7iqWSOYEGJ4hYbNCI0RG/aMHVbX/Pv6mkQ/3vSOF3RHU nAPK2GYiw/Z7WusRU2o1FuAfw4Q+mhXRqCpI1G8T7WaP+tXVQEWr48TVOevOncwa 4v6yt9nTxVTRh9R/ryiWkAsOZPj1NzN8s6Nt1nSu8LaVYrkBjQRilgV+AQwAmtOe vlakjZSJNdD15QI5upWf7twV0x01gpLqfyWG3KsVBQkSmwFDyq/urIkCv2G5pWRY mq9+gHGGnu20rSsuHpZaBVpu7WKrUfOW3rEJe2dJklUn7mV+NglpNDfHuix/OyhB keN68ixDZktKe8tXBcajHHBc3wcqpbQzEhDIcJ67e1zVYupuJ0SvS6CNZrdFp5CX HCe/23Po91zdB97Nt1QEQ76T6WAEsqqEEyOFtnWKUVk/oJC7H3dzeWhVyASLNn4V FeW/9kEkhdSmPPtFNGYOtYpMbMDYGQCkxGqQmJWeD+PQEWS6mU4NQ9pkyyqNDAzU +NnSnnf+VN/pPDEye27AqB+8IKuAXTExq/QRKZGV/dPezyn1eOWFKTXOoyAb6/Ti 8/zGMSjqIvlPPJGH2hhj3bxd/uYbT+KwRDBr6q2rLhqfqwT88bCxi3Ss28s4+I8u Lq0YRaaCmjykIT+qWSudul8mWfACORzWla4rMgqicMJSIE4rQvDjvTDz9gD3ABEB AAGJAbYEGAEIACAWIQTPFoHu/aJ7lguwzn6cTO5XBbNhcgUCYpYFfgIbDAAKCRCc TO5XBbNhco0bDAC0XcAt3++/axhvRbZz6Bb3GfojdWY0/MM2iV8gGyKwi3yjQwHA Cxg/EC+A4sC69gPuWeJHll2o3PWse61/+eqvMqN5oQkivMN61B120pyzEfA9TZEL vg5kIDBbuVXn4FlQwHPaNeBUcfEpVWEAPQKs2UWcKrStabIL+N1vmZJepmVYkmAZ rfdH7E8OaFmlShfO8N150mhQGT9W6Li6MMzRzRWaSNuknSEUqWvimfpjLiiPkdbG mzTKWQ1ZavPdaTWASO50qISFqSgYlcZSJCGgFJc6u4kABZ7LgFCAJc3U8TT8Bj+F jbLcNDytzrupSUFoMm0PDsFqhEXacUM8MBAS4kDNOfv3fqMai6lONDiMfOhaoIll 5bdHQKCoz7qtjI56HauctDvdbGK4v8mTZW3V6tFpInkkh7BJkiNQV1FcWO3hLELF NmBk65fMk0s806xFlsWpU8WVNtB8QQUKVYo/aYZfSeLZZB1dLS9CQk8RoLsyOcZJ lK2yau+ZeM+XxvM= =Z0Yb

-----END PGP PUBLIC KEY BLOCK-----