Bug Bounty Programme

1. What is in scope

Everything we build and run ourselves is in scope, from the page you are reading to the endpoints the app talks to.

• The payfar.org website and its subdomains
• The PayFar web app and its installable mobile version
• Web services and every API endpoint
• Sign-in and authentication: password, one-time code, Google sign-in, two-factor and password reset
• The user wallet: balance, deposits, bank withdrawals and the transaction ledger
• The virtual card: issuance, top-up, card-detail reveal, lock and unlock
• Identity verification and the documents users submit
• AI agent payments: the OAuth flow, access tokens, limits and spend policies
• The partner programme: referral codes, attribution and commission maths
• The admin panel and internal tooling, where reachable from outside

2. What is out of scope

Please do not report these. They carry no reward, and triaging them takes time away from the reports that matter.

• Third-party services and the infrastructure of our card issuing and processing partners
• Denial of service (DoS and DDoS), and any test that affects real users
• Social engineering of staff, users or the support team, and phishing of any kind
• Physical access to our office, staff or equipment
• Self-XSS, and any issue that needs the victim to be talked through the attack by hand
• Raw automated scanner output with no proof of exploitation
• Missing security headers, SPF and DMARC configuration, or an outdated library version, with no exploitation scenario
• Rate limiting and brute force against public endpoints
• Internal redirects, software version disclosure and cosmetic bugs with no security impact
• Issues that only affect unsupported browsers or operating systems

3. Severity levels and response times

We rate severity on the real impact to user funds and user data, not on the name of the vulnerability class. The times below are our first-response commitment, not a fix deadline; we keep you updated until the fix ships.

4. Rewards

The figures below are the ceiling for each level. The final amount depends on report quality, reproducibility and real impact: a report with precise steps and clear proof lands closer to the top of its band.

5. How rewards are paid

Rewards are paid once the vulnerability is confirmed and fixed. Payment goes to your PayFar balance or onto your virtual card, so you will need a verified PayFar account to receive it.

Each issue pays the first person to report it. Duplicates, issues we had already logged, and vulnerabilities already being fixed are marked as duplicates and carry no reward, but you get the same response and the same transparency.

Several reports with one underlying root cause count as a single issue. If you would like, we will name you in the PayFar security acknowledgements.

6. Rules of engagement

These rules are the line the programme draws. Following them is what separates a test from an attack.

• Test only against your own account, and create a separate account for testing
• Do not touch other users' data; if you reach it by accident, stop there and say so in the report
• Test by hand: heavy automated scanning and bulk traffic are not allowed
• Do not delete or alter any data, and do not take the service down
• Stop as soon as the vulnerability is proven; going further is not research
• Do not retain or move any data you came across while testing
• Do not disclose publicly until it is fixed and we have agreed on the timing

7. How to report

Send your report to security@payfar.org. The more precise it is, the faster triage goes and the closer the reward lands to the top of its band. Include:

• A short title and the severity you would assign it
• The exact domain or endpoint, and the date and time you tested
• Step-by-step reproduction, with the raw requests and responses
• A screenshot or a short proof-of-concept video
• The real impact: who loses what
• The test account you used
• Your name or handle for the acknowledgements, and how to reach you

8. Safe harbour

If you stay within this page, PayFar treats your work as authorised security research: we will not sue you, we will not refer you to the authorities, and we will not close your account over a report.

That commitment holds as far as the rules in section 6 are followed. Testing that touches other users' data, disrupts the service, or comes with extortion or a threat to publish falls outside safe harbour and is treated like any other unauthorised access.

This page is not a contract, and PayFar may change the programme's terms. A report sent before a change is assessed under the terms in force when you sent it.

9. Contact

Vulnerabilities: security@payfar.org

Everything else: info@payfar.org

If you have had no reply within 7 business days, send it again: the message may not have reached us.