Responsible Disclosure

We welcome reports of security vulnerabilities in SwissPay. This page explains how to send one and what you can expect in response.

How to report

Send the report to security@swisspay.ai. Include:

• A clear description of the vulnerability and where it is.
• Steps to reproduce, including any specific account state, URLs, or payloads.
• The potential impact — what an attacker could do.
• Your name and how you would like to be credited (or not).

If the report contains anything sensitive (proof-of-concept payloads, internal data accessed during testing), please encrypt the email. We will accept a PGP-encrypted message on request — reach out for the current public key.

Our commitment to you

• Acknowledgement of every report within 2 business days.
• An initial triage assessment within 5 business days — severity, whether we can reproduce, and an indicative timeline.
• Status updates at least every 14 days until the issue is closed.
• Public credit in our security advisories (if you want it).

Scope

In scope:

• The SwissPay API at https://app.swisspay.ai and any other endpoint we operate.
• The SwissPay documentation site (this site).

Out of scope:

• The infrastructure of our sub-processors — report these to them directly.
• Social engineering of SwissPay staff or our customers.
• Denial-of-service attacks against any production service.
• Reports based on scanner output alone, without a demonstrated vulnerability.
• Attacks that require access to a victim's device, account, or network.
• Issues in third-party software outside our control (browsers, operating systems, etc.).

Safe harbour

If you act in good faith, follow the rules above, and give us a reasonable chance to fix the issue before publishing, we will not pursue legal action against you for your research. This includes:

• Not testing beyond what is necessary to demonstrate the vulnerability.
• Not accessing or modifying data that is not your own.
• Not exfiltrating, retaining, or sharing customer data.
• Not exploiting the vulnerability for any purpose other than confirming it exists.

Disclosure

We aim to publish a security advisory after the issue is fixed and our customers have had a reasonable window to update where applicable. Disclosure timing is coordinated with you. We follow a default 90-day disclosure window from initial report — extensions are possible by mutual agreement.