Skip to main content

Legal

Responsible Disclosure

Last updated: 5 October 2026

If you believe you have discovered a vulnerability in one of Mypinpad’s solutions, please report it to respdisclosure@mypinpad.com. We take security seriously and appreciate the work of researchers who help us keep our customers safe.

Eligibility

To submit a report, you must:

  • Comply with all applicable laws in any region involved in your research and submission.
  • If you are a minor, obtain parental or guardian approval before submitting.
  • Understand that public recognition is the only form of compensation we offer. We do not operate a paid bug bounty programme.

Scope

In scope

  • The mypinpad.com website
  • The Mypinpad MPoC SDK for Android and iOS
  • The Wattle and Acacia white-label applications
  • Legacy Mypinpad Android CPoC and SPoC, and iOS SPoC, applications still in service

The following vulnerability classes are covered:

  • Server-side or remote code execution (RCE)
  • Authentication or authorisation flaws, including insecure direct object references and authentication bypass
  • Injection vulnerabilities (SQL, XML, and similar)
  • Directory traversal
  • Significant security misconfiguration with a verifiable vulnerability
  • Sensitive or personally identifiable information disclosure
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF) in privileged contexts

Out of scope

Any application, software, or service not explicitly listed above is out of scope. Activity targeting out-of-scope assets will be rejected and may be reported.

How to contact us

Send detailed vulnerability reports to respdisclosure@mypinpad.com. Please include enough information for us to reproduce the issue, including the affected asset, steps to reproduce, and any proof-of-concept material.

When reporting, you must:

  • Respect the privacy of merchants and their customers.
  • Maintain transparency and openness in your communications.
  • Use email as the only formal channel for reporting. Public disclosures via social media or other channels will not be treated as formal submissions.

Terms

Participation in our responsible disclosure process is voluntary. We do not provide monetary compensation, but contributors may receive public recognition where appropriate. By submitting a report, you agree to the eligibility, scope, and conduct requirements set out above.