Reporting a security issue

Scope

This policy covers payout.one and its subdomains, our APIs and the Payout mobile apps. Where possible, test against our sandbox environment rather than production; see our developer documentation. Issues in third-party services we use are out of scope; please report them to the vendor.

How to report

Email security@payout.one in English or Slovak with:

• the affected host, URL or app version
• a description of the issue and its impact
• steps to reproduce or a proof of concept

What to expect

• We acknowledge your report within 5 business days.
• We share our initial assessment within 10 business days.
• We keep you informed while we work on a fix and tell you when it is resolved.

Please do

• Test only against your own accounts and data.
• Access only as much data as you need to demonstrate the issue. Stop and report as soon as you reach data that is not yours; do not keep or share it.
• Keep the issue confidential until it is fixed, and coordinate any public disclosure with us. We ask for up to 90 days.

Please don't

• Run denial-of-service attacks, load tests or high-volume automated scans.
• Use social engineering, phishing or physical attacks against our staff, customers or offices.
• Take over subdomains, claim third-party services or publish content on our domains. The DNS record and the provider's response are enough evidence; report those.
• Make payments, withdrawals or other financial operations on accounts that are not yours.

Rewards

Payout does not run a bug bounty programme. Any reward is at our discretion, depends on the impact we confirm and is not negotiable. We do not reimburse costs incurred during research, such as subscriptions, accounts or tools.

Usually out of scope

• Reports from automated scanners without a demonstrated impact
• Missing security headers, cookie flags or SPF/DKIM/DMARC settings without a working attack
• Clickjacking on pages without sensitive actions
• Self-XSS, version disclosure, rate limiting on non-sensitive endpoints
• Issues that require a rooted or jailbroken device, physical access to an unlocked device, or an already compromised user machine

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised and will not pursue legal action against you. If a third party takes legal action against you for such research, we will make it known that you acted in line with this policy. If you are unsure whether something is allowed, ask us at security@payout.one before you go ahead.

Your personal data

We use the personal data you send us, such as your name or pseudonym, contact details and the content of your report, only to handle your report: to communicate with you, to verify and fix the issue and, if we decide to pay a reward, to make the payment. We do not publish it. For details on how long we keep it and on your rights, see our privacy policy or contact our data protection officer at dpo@payout.one.