> ## Documentation Index
> Fetch the complete documentation index at: https://staging-docs.crosspoint.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Vulnerability Reporting

> How to report a security issue in Crosspoint.

Keeping your money and your customers' data safe comes first. If you've found a security issue in Crosspoint, please tell us.

## Making a report

Email [support@crosspoint.finance](mailto:support@crosspoint.finance) with **Security** in the subject. Please include:

* A clear summary of the issue and what someone could do with it.
* Detailed steps to reproduce it.
* Relevant details about your setup (browser, OS, version numbers).
* Any proof-of-concept code, if you have it.

Please don't share the issue publicly until we've fixed it. We'll keep you updated and may ask for more details.

## Timeline

We'll get back to you within a few days to acknowledge your report.

## What we're most interested in

* Getting into an account or a store without permission, or getting more access than your role allows.
* Exposure of personal data.
* Access to data that isn't meant to be public without signing in.
* Anything that moves money where it shouldn't go.

## In scope

* The Crosspoint dashboard and checkout ([app.crosspoint.finance](https://app.crosspoint.finance))
* The Crosspoint API ([api.crosspoint.finance](https://api.crosspoint.finance))
* The sandbox ([sandbox.crosspoint.finance](https://sandbox.crosspoint.finance) and its API)

## Out of scope

* Automated scanning.
* Social engineering.
* Denial of service attacks.
* Attacks that need physical access to someone's device.
* Theoretical attacks you can't actually exploit.
* Man-in-the-middle attacks.
* Clickjacking or UI redress attacks.
* CSV injection.
* HTML injection.
* Missing security headers, weak TLS cipher suites or DNS setup issues.

## Please be considerate while investigating

* Only test with your own account (or get the account owner's permission first). The [sandbox](https://staging-docs.crosspoint.finance/africa/sandbox.md) is the best place to test.
* Don't change, delete or keep private data that isn't yours.
* Avoid anything that could break or slow down our services.
* If you get access to our systems, don't try to go further.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.