Report a vulnerability

Anything on pay.perly.io: the dashboard, the checkout pages, the buyer portal, the API, pay.js and the emails we send.

Above all: a way to change where money goes, to read another business's data, to sign in as someone else, or to skip a check — screening, a code, a role.

Supabase, Cloudflare, Telegram, the blockchains and wallets themselves — tell them.

Floods (DoS), spam, and tricking our people. A scanner's findings with no harm shown, headers that change nothing, and self-XSS.

Use test mode and a business of your own. Never touch other people's data or money; stop and tell us as soon as you see someone else's.

Never send us a seed phrase or a private key, yours or anyone's. Perly Pay never holds one, and never asks.

What you found, the steps to see it again, and what it lets someone do. Choose Security vulnerability in the contact form.

Leave an email we can answer. Security reports are kept for a year, then deleted.

We read every report, answer at the address you leave, and tell you when it is fixed.

Give us time to fix it before you publish. We'll credit you, if you like. There is no bounty programme yet.

Tools find this page from /.well-known/security.txt.