Security at AcmePay
How we protect funds and data, and how to report a problem.
Reporting a vulnerability
We run a private responsible-disclosure programme. Email security@acmepay.duckdns.org. Our machine-readable policy is at /.well-known/security.txt.
Please do not test against shared infrastructure or non-production environments without asking first. If you need a target, request sandbox credentials and we will scope an engagement.
Scope
| In scope | www.acmepay.duckdns.org, api.acmepay.duckdns.org, the merchant dashboard |
|---|---|
| Out of scope | staging and sandbox environments, third-party status page, marketing subdomains, anything under /internal/ |
Practices
- Card data is tokenised; we do not store PANs.
- All API traffic is TLS 1.2+; HSTS on all production hosts.
- API access uses short-lived bearer tokens. Legacy API keys (
apk_live_*) are being phased out withv1. - Secrets are managed outside source control and rotated on a schedule.
- Production changes ship through CI with mandatory review.
Acknowledgements
Thanks to the researchers who have reported issues responsibly: @r0bex, @kestrel-sec, @m.iqbal, @0xtabby.