Report it. In good faith.
ReliefPay is early-stage infrastructure for card-based aid pilots. If you find a vulnerability, we want to hear from you before anyone else does.
What’s in scope.
- The web application at
reliefpay.organd its sub-routes. - The operator console, Android vendor terminal, NFC card provisioning flow, vendor sync, settlement records, and proof-recording boundary.
- Optional public proof-recording components, where explicitly enabled for a programme (details on the commitments page when published).
- Client-side and Android cryptographic operations used for vendor sync, offline queue sealing, and proof references.
- Authentication, programme membership checks, card lookup, card-status privacy, and role-based access controls.
- Vulnerabilities in upstream dependencies (Supabase, Vercel, Base RPC providers, Flutterwave, or Android itself). Please report those to the relevant vendor directly.
- Denial-of-service attacks requiring sustained traffic or brute force.
- Social engineering attacks against staff.
- Physical attacks or attacks requiring physical access to a device.
- Reports generated solely by automated scanners without a working proof of concept.
Tell us about it.
Write to hello@reliefpay.org. Encrypt with our PGP key if the finding is particularly sensitive (key fingerprint and full key available on request).
- A clear description of the vulnerability.
- Steps to reproduce, including any required request payloads, account states, or specific timing.
- An assessment of the impact: what could an attacker achieve?
- Any proof-of-concept code, screenshots, or transaction hashes.
- Give us reasonable time to respond and fix before public disclosure. A standard 90-day window is appropriate for most findings; critical issues may justify a shorter window coordinated with us.
- Do not access, modify, or exfiltrate data that is not your own.
- Do not execute denial-of-service, social engineering, or physical attacks.
- Keep the finding confidential until a fix is deployed.
What we will do.
If you report in good faith and within the terms above, we will:
- Acknowledge receipt within 72 hours.
- Provide a substantive triage response within 7 days, including our assessment of severity and expected timeline.
- Keep you informed of progress through to remediation.
- Not pursue legal action, including under computer misuse or similar statutes, against researchers acting in good faith and within this policy.
- Publicly credit you in our release notes, if you wish.
- Report substantive findings and their fixes in a public advisory, coordinated with you, once remediation is complete.
We are currently pre-revenue and cannot offer paid bug bounties. We are working on a bounty programme for the mainnet launch; until then, public credit and the real gratitude of a team that benefits from your work is the best we can offer.
security.txt
A machine-readable version of this policy, in the format specified by RFC 9116, is served at:
https://reliefpay.org/.well-known/security.txt
Automated security researchers and scanners should use that endpoint as the canonical source of contact information.