Security and vulnerability disclosure
How KukoPay protects merchant and payment data, how to report a security vulnerability responsibly, and the rules to follow when testing the platform.
Zuletzt aktualisiert: 2026-10-02Version: 2026-10-02
Diese Seite gibt es nur auf Englisch und Chinesisch. Unten steht die englische Fassung. Bei Abweichungen gilt die chinesische Fassung.
How we protect data
- Merchants never handle card details. Buyers enter them in the hosted checkout; they are never shared with the merchant, and merchants are not allowed to send them to us.
- Secrets are encrypted at rest. API keys, webhook secrets, bank account numbers and identity document numbers are stored encrypted; API keys are looked up by fingerprint and shown in full only when issued.
- Sandbox and live are separate. Test and live keys, ledgers and data never mix, and the environment follows from the key, not from a request field.
- Every request is authenticated and metered. Per-merchant rate limits, optional IP allowlists, and an
X-Request-Idon every response. - Webhooks are signed with HMAC-SHA256, and secret rotation keeps the old secret valid for 24 hours so no delivery is lost.
- Access is limited by role for merchant teams and for our own operators. Operator actions on merchant accounts are recorded in an audit trail that cannot be edited.
- Uploads are private. Verification documents and dispute evidence are stored in a private bucket, readable only by the merchant's members and authorised operators.
Reporting a vulnerability
If you believe you have found a security issue in KukoPay, email [email protected] with "Security" in the subject. Include the affected URL or endpoint, steps to reproduce and the impact you observed. Our machine-readable contact is at /.well-known/security.txt.
We aim to acknowledge reports within 3 business days and to keep you informed until the issue is resolved.
Rules for testing
- Test only against your own account, and use the sandbox whenever possible.
- Do not access, change or delete data that is not yours; stop and report as soon as you see someone else's data.
- Do not run denial-of-service, spam, social engineering or physical attacks, and do not test the systems of our Payment Partners.
- Do not use real or stolen card data.
- Give us reasonable time to fix the issue before disclosing it.
We will not pursue legal action against research that follows these rules in good faith.