Responsible Disclosure.
Contributing to a secure platform. If you discover a potential vulnerability or security concern in our systems, we encourage you to report it responsibly.
Thank you, from the PayFacLite® security team. Helping us to protect our environment. For security researchers and ethical hackers.
Our responsible disclosure process is our commitment to security and transparency. We welcome and value the contributions of security researchers and ethical hackers in identifying potential vulnerabilities in our systems. If you have discovered a security issue or vulnerability within our platform, we encourage you to report it to us promptly.
Upon receiving your report, our security team will assess and verify the issue. We prioritise the security and privacy of our users and aim to address any identified vulnerabilities promptly. We request that all disclosures adhere to responsible guidelines, refrain from exploiting or sharing the issue publicly, and allow us the necessary time to investigate and implement a resolution.
Your cooperation in reporting any potential security concerns helps us maintain a secure environment for our users and fortify our systems against potential threats. Thank you for your support in keeping our platform safe and secure for everyone.
What is in scope
Our disclosure policy covers the following areas of our environments.
- payfaclite.com
- platform.payfaclite.com
- PayFacLite® API endpoints
How to report
To report a potential vulnerability, email our dedicated security team at security@payfaclite.com. Please submit detailed information about the issue, including the steps to reproduce it.
What we do not permit
PayFacLite® does not permit security research of our systems in the following cases.
- Denial-of-service attacks, including but not limited to SYN flood, smurf attack and ping flood
- Illegal or regulatory violations
- Attempting to access our databases
- Ransomware attacks, or requests for compensation to disclose vulnerabilities
- Social engineering of any type
- Exploiting a vulnerability, or impacting or attempting to impact our services
What happens next
Once we have received your report we will acknowledge receipt, and then complete the following.
- We will look to complete our review within 7 working days.
- We will update you throughout our remediation process.
- We will confirm once the vulnerability has been remediated.
Should the vulnerability you report be valid, we will list your name on this page with a message of thanks.