Vulnerability disclosure

SET-SEC-010 · Version 1.0 · 2026-11-09

SET welcomes reports from security researchers. If you believe you have found a vulnerability in a SET system, tell us before telling anyone else, and give us a reasonable time to fix it.

How to report

Email support@simpleeasytransactions.com with the subject line Security report. Include:

the address or API route affected;
what you did, step by step, and what happened;
what an attacker could gain.

Do not include real personal data, credentials or payment details in the report. If you came across any, say so and describe the kind of data only.

The machine-readable version of this policy is at /.well-known/security.txt.

What to expect

SET acknowledges a report within three business days.
SET tells you whether it could reproduce the issue and what it intends to do.
SET tells you when the issue is fixed, and credits you if you wish.

SET does not run a paid bug bounty.

In scope

simpleeasytransactions.com and wallet.simpleeasytransactions.com
The SET API, SET Merchant API and SET Direct Deposit API on those hosts
The staging host wallet-staging.simpleeasytransactions.com, which is the right place to test

Out of scope

Systems run by SET's providers. Report those to the provider.
Denial of service, volumetric testing and spam.
Social engineering of SET's staff or customers, and physical attacks.
Reports from automated scanners with no demonstrated impact.

Rules for testing

Use the sandbox and test keys. Never move real money that is not yours.
Use only accounts you own. Do not read, change or delete another person's data; stop and report as soon as you can show access is possible.
Do not degrade the service for others.

Safe harbour

SET will not take legal action against, or ask law enforcement to investigate, a researcher who acts in good faith within this policy. If a third party takes action against you for activity that followed this policy, SET will make it known that the activity was authorised.