Elixirpay's Responsible Disclosure Policy.
Effective Date: July 1, 2026
We take the security of our platform seriously, and we recognize the value independent
researchers bring in helping us find issues before they can be exploited. This policy
describes how to report a suspected vulnerability responsibly, and the commitment we make to
researchers who do.
1. Our Commitment
If you report a vulnerability in good faith and in line with this policy, we commit to
acknowledging your report promptly, investigating it thoroughly, keeping you updated on our
progress, and not pursuing legal action against you for the research described in the Safe
Harbor section below.
2. Scope
This policy covers security issues in:
- The Elixir Pay website, dashboard, and customer-facing applications
- Our public APIs, SDKs, and webhook infrastructure
- Any subdomain or system operated directly by Elixir Pay
3. Reporting a Vulnerability
Send a report to our security team through the contact details on this site, including as
much detail as possible. Please report privately and give us a reasonable window to
investigate and remediate before discussing the issue publicly.
4. What to Include
- A clear description of the vulnerability and its potential impact
- Step-by-step instructions to reproduce the issue
- Any proof-of-concept code, screenshots, or request/response captures
- The affected URL, endpoint, or component, where known
5. Our Process
We aim to acknowledge new reports within a few business days, and to keep you informed as we
validate and remediate confirmed issues. Timelines vary with severity and complexity, but we
will communicate progress rather than leave a report unanswered.
6. Safe Harbor
We will not pursue legal action against researchers who discover and report vulnerabilities in
good faith, provided they:
- Avoid privacy violations, data destruction, or service disruption during testing
- Only interact with accounts they own or have explicit permission to test
- Do not publicly disclose an issue before we've had a reasonable opportunity to fix it
- Do not exploit a vulnerability beyond what's necessary to demonstrate it
7. Out of Scope
Reports involving denial-of-service testing, social engineering of our staff or customers,
physical access attempts, or spam/phishing are not covered by this policy and should not be
attempted against our systems.
Contact Us