Unitpay processes payments, so we take the security of our software and our merchants' integrations seriously. Thank you for helping keep Unitpay and its users safe.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report privately through either channel:

• GitHub Private Vulnerability Reporting (preferred) — open the Security tab of the affected repository and click Report a vulnerability. The report stays private to the maintainers until a fix is released.
• Email — security@unitpay.ru. Use a subject line that makes the severity clear, and encrypt sensitive details if you can.

Please include as much of the following as possible so we can reproduce and triage quickly:

• The affected repository, version or commit, and environment (language runtime version, OS, transport).
• Type of issue (e.g. signature forgery, IP-allowlist bypass, injection, information disclosure).
• Step-by-step reproduction, a proof-of-concept, or exploit code.
• The impact — what an attacker can achieve.

• Acknowledgement within 3 business days.
• An initial assessment and severity rating within 10 business days.
• Regular updates on remediation progress, and credit in the release notes once a fix ships — unless you prefer to remain anonymous.

We follow coordinated disclosure: please give us reasonable time to release a fix before disclosing publicly.

In scope:

• Code in this organization's repositories (SDKs, libraries, tools).
• Vulnerabilities that let an attacker forge webhooks, bypass signature or IP verification, leak secret keys, or otherwise compromise a correct integration.

Out of scope:

• The Unitpay production platform, dashboard, and public website (unitpay.ru) — report those through your merchant account or help.unitpay.ru.
• Vulnerabilities in third-party dependencies (report them upstream), unless our default usage is what makes them exploitable.
• Findings that require a compromised host, physical access, or social engineering.

Security fixes are applied to the latest released version of each library. For packages that follow semantic versioning, the current major line receives security updates; older majors are updated at the maintainers' discretion.