Legal
Vulnerability disclosure
Last updated this month
If you find a security problem in the extension, this is how to report it and what you can expect back.
01. In scope
The extension script served from our CDN, the dashboard, the public API endpoints, and the npm packages published under our name.
Anything that would let an attacker read another merchant's events, escalate a scoped key, or inject code into a checkout served to a customer is in scope and treated as critical.
02. Out of scope
Denial of service, social engineering of our staff, physical attacks, and issues that require a compromised device or an already-stolen credential.
Findings that depend on a gateway-side configuration you control, rather than on our code, belong with that gateway's own disclosure programme.
03. How to report
Email [email protected] with the affected endpoint, a reproduction, and any logs. Encrypt with our published key if the report includes payment metadata.
Do not test against a live merchant account you do not own. Use your own test-mode account, and do not access data that is not yours.
04. What we commit to
We acknowledge a report within two business days and give an initial assessment within five. We keep you updated until the issue is resolved and tell you when a fix ships.
We do not pursue legal action for research conducted in good faith within this scope and this set of rules. We will credit you in the changelog if you want credit.
05. Severity and timelines
Critical issues — code injection into checkout, cross-tenant data access — are mitigated as soon as practically possible, with a target of 72 hours for a mitigation and 14 days for a permanent fix.
Lower severity findings are batched into the regular release cycle. Either way, you get a decision and a date rather than silence.
Questions about this document: [email protected]. Samurai Bypasser is a trading name used for this product.