Responsible disclosure

Found a security issue? Tell us first.

We work with researchers to fix problems before anyone gets hurt. If you report in good faith, we will not take legal action against you.

security@relaypay.dev

We reply within two business days.

Read the full policy

In scope

  • The payments API at api.relaypay.dev
  • The merchant dashboard at app.relaypay.dev
  • Our official SDKs for Node, Python, and Go

Out of scope

  • Denial of service or load testing
  • Phishing or social engineering of our staff
  • Scanner output with no proof of impact