Vulnerability disclosure
Security is core to a payments platform. We take the security of our systems, merchants and their customers seriously. If you believe you've found a security issue, please tell us.
How to report
Email security@coinduro.com with:
- A description of the issue and its potential impact
- Steps to reproduce, affected URLs or endpoints, and any proof of concept
- How you'd like to be credited, if at all
We aim to acknowledge reports within 5 business days and will keep you updated as we investigate and fix the issue.
Scope
coinduro.com, coinduro.co, coinduro.io and their subdomains.
Please don't
- Access, modify or delete data that isn't yours, beyond what's needed to demonstrate the issue
- Run denial-of-service, load or spam tests
- Use social engineering, phishing or physical attacks
- Disclose the issue publicly before we've had a reasonable chance to fix it
Out of scope
- Findings from automated scanners without a demonstrated impact
- Missing best-practice headers or TLS settings without a concrete exploit
- Clickjacking on pages with no sensitive actions, self-XSS, and rate limiting on non-sensitive endpoints