Vulnerability Disclosure Policy

Merchants rely on PapelShip to take payments and on qPapel to protect their software. We welcome reports from researchers who find security issues and want to help us fix them.

In scope

• papelship.com and the PapelShip dashboard.
• Hosted checkout and stores on mypapel.com.
• The PapelShip API, webhooks and the qPapel authentication servers.
• The qPapel C++ and C# SDKs.

Out of scope

• Denial of service, load testing or attempts to degrade availability.
• Social engineering, phishing or physical attacks against staff or offices.
• Content, code or configuration controlled by individual merchants.
• Third-party services we use, which should be reported to their owners.
• Findings without a demonstrated security impact, such as missing headers on static pages.

Email [email protected] with the subject line "Security report". Please include:

• A description of the issue and its potential impact.
• The affected URL, endpoint, SDK version or component.
• Steps to reproduce, and a proof of concept where possible.
• How you would like to be credited, if at all.

• Only test against accounts and stores you own, or with explicit permission.
• Do not access, modify or delete data belonging to other users; stop and report as soon as you reach it.
• Do not use a finding to bypass another merchant's qPapel protection or to obtain licenses.
• Do not run automated scans that create heavy traffic.
• Keep the details confidential until we have confirmed a fix.

If you follow this policy, act in good faith and give us reasonable time to respond, we will not pursue legal action against you for your research and will work with you to understand and resolve the issue.

We will acknowledge your report, keep you informed while we investigate and let you know when the issue is resolved. We do not currently run a paid bug bounty programme.