Skip to main content
Keeping your money and your customers’ data safe comes first. If you’ve found a security issue in Crosspoint, please tell us.

​
Making a report

Email support@crosspoint.finance with Security in the subject. Please include:
  • A clear summary of the issue and what someone could do with it.
  • Detailed steps to reproduce it.
  • Relevant details about your setup (browser, OS, version numbers).
  • Any proof-of-concept code, if you have it.
Please don’t share the issue publicly until we’ve fixed it. We’ll keep you updated and may ask for more details.

​
Timeline

We’ll get back to you within a few days to acknowledge your report.

​
What we’re most interested in

  • Getting into an account or a store without permission, or getting more access than your role allows.
  • Exposure of personal data.
  • Access to data that isn’t meant to be public without signing in.
  • Anything that moves money where it shouldn’t go.

​
In scope

​
Out of scope

  • Automated scanning.
  • Social engineering.
  • Denial of service attacks.
  • Attacks that need physical access to someone’s device.
  • Theoretical attacks you can’t actually exploit.
  • Man-in-the-middle attacks.
  • Clickjacking or UI redress attacks.
  • CSV injection.
  • HTML injection.
  • Missing security headers, weak TLS cipher suites or DNS setup issues.

​
Please be considerate while investigating

  • Only test with your own account (or get the account owner’s permission first). The sandbox is the best place to test.
  • Don’t change, delete or keep private data that isn’t yours.
  • Avoid anything that could break or slow down our services.
  • If you get access to our systems, don’t try to go further.