Responsible disclosure policy

Our commitment

Protecting our customers’ funds and data is central to what we do. We welcome reports from security researchers and customers who find a vulnerability in our systems, and we will work with you to understand and fix it. This policy explains what you can test, how to test safely and how to report what you find.

In scope

• Public websites under *.localpayment.com, including localpayment.com.
• The Localpayment API: Production (api.v3.localpayment.com) and Stage (api.stage.localpayment.com).
• The Business Portal (ui.v3.localpayment.com).

Test only with accounts and credentials you are authorized to use. If you are a Localpayment customer, test in your Stage environment rather than in Production. Some *.localpayment.com subdomains are operated by third-party providers; if a report concerns one of them, we will coordinate with the provider.

Out of scope

• Denial-of-service attacks, load or stress testing, and any testing that degrades service for others.
• Social engineering, phishing or physical attempts against our employees, offices, customers or partners.
• Services operated by third parties, such as banks, card networks, local payment rails or our independent ethics channel. Report those issues to the provider.
• Findings without a demonstrable security impact, such as missing security headers or cookie flags on their own, version banners, clickjacking on pages without sensitive actions, self-XSS, logout CSRF or unvalidated output from automated scanners.
• Email configuration reports (SPF, DKIM, DMARC) without a working exploit.

Rules of engagement

• No denial of service. Do not run tests that could disrupt or degrade our services, and keep automated scanning to a low rate.
• No social engineering. Do not target people — employees, customers or partners — through phishing, pretexting or any other means.
• No data exfiltration. Access only the minimum data needed to prove the issue. Do not download, copy, keep, change or delete data. If you encounter personal data, cardholder data or credentials, stop and report it immediately.
• Stop at proof. Once you have confirmed a vulnerability, stop. Do not escalate privileges, move laterally, create persistence or chain further attacks without our written agreement.
• No real transactions. Never move funds, create real payments or payouts, or interact with accounts that are not yours.
• Keep it confidential. Do not share details of the issue with anyone until we have fixed it and agreed on disclosure with you.
• Act in good faith and within the law. Do not make your report conditional on payment or any other demand.

How to report

Email cybersecurity@localpayment.com with the subject “Vulnerability report” and a short title. We read reports in English, Spanish and Portuguese. Please include:

1. The affected asset: URL, API endpoint, parameter or Business Portal screen.
2. The type of vulnerability and its potential impact.
3. Step-by-step instructions to reproduce it.
4. A proof of concept — requests and responses, screenshots or a short video — with any personal or sensitive data redacted.
5. The date and time of your testing and the IP addresses you used, so we can match your activity in our logs.
6. Your name or handle, how to contact you, and whether you would like to be credited.

Never include real card numbers, passwords or other people’s personal data in your report. Describe them instead.

What to expect

• Acknowledgement. We confirm receipt of your report promptly.
• Assessment. Our security team validates the issue, assesses its severity and may ask you for more details.
• Updates. We keep you informed of our progress and let you know when the issue is resolved.
• Remediation. We prioritize fixes by the risk they pose to our customers and their data.
• Coordinated disclosure. If you plan to publish your findings, we agree on the timing with you once a fix is in place. With your permission, we are glad to acknowledge your contribution.

Safe harbor

Localpayment will not take legal action against researchers who discover and report vulnerabilities in good faith and in line with this policy.

Machine-readable contact (security.txt)

Our security contact details are also published in machine-readable form, following RFC 9116, at https://localpayment.com/.well-known/security.txt.

Other requests

• Suspected fraud, or a problem with your account or a transaction: support@localpayment.com, available 24/7.
• Ethics or misconduct concerns: our independent ethics channel.