Vulnerability Disclosure Policy

1. Purpose

Paylithix Inc. welcomes reports of security vulnerabilities in the Gatelithix Gateway. This policy tells security researchers how to report a vulnerability, what to expect from us, and the conditions under which we will not pursue legal action. It is the policy referenced by our /.well-known/security.txt (RFC 9116) and supports PCI DSS 4.0.1 Requirement A1.2.3 (responsible-disclosure contact for a multi-tenant service provider).

2. How to report

• Email: security@paylithix.com
• Include enough detail to reproduce: affected endpoint or URL, a description of the issue, and proof-of-concept steps or a minimal payload.
• Please encrypt sensitive details if possible and do not include real cardholder data (PAN, CVV, track data) in your report — a redacted or synthetic example is sufficient.

We acknowledge reports within 3 business days and aim to provide a remediation timeline within 10 business days of validating the issue.

3. Scope

In scope:

• api.gatelithix.com (Gateway API)
• dashboard.gatelithix.com (merchant dashboard)
• docs.gatelithix.com (this documentation site)
• The published SDKs and the hosted payment fields

Out of scope:

• Findings that require physical access, social engineering, or a compromised end-user device.
• Volumetric denial-of-service (DoS/DDoS) and traffic-generation testing.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Third-party services we consume (report those to the respective provider).

4. Researcher expectations (safe harbor)

If you make a good-faith effort to comply with this policy, we will consider your research authorized, will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly. Good faith means:

• You avoid privacy violations, data destruction, and service degradation.
• You only interact with accounts you own or have explicit permission to test, and you stop and report immediately if you encounter cardholder data or other sensitive data.
• You give us a reasonable time to remediate before any public disclosure, and you coordinate disclosure timing with us.

5. Our commitments

• We will not take legal action against researchers acting under Section 4.
• We will keep you informed of remediation progress and confirm when the issue is resolved.
• With your permission, we are happy to credit you once a fix is deployed.

6. Review

This policy is reviewed at least annually and whenever the disclosure process or in-scope surface changes materially. The Expires field in security.txt is kept within twelve months per RFC 9116 §2.5.5.