Voidly security
Report a security vulnerability.
If you notice a possible weakness in a Voidly product, tell us privately. A report can describe what you observed; you do not need to access anyone else's data or make a live transaction to prove it.
Send a private report
Use the security inbox for suspected vulnerabilities. Remove secrets and personal information before sending.
Email security@voidly.aiBefore you test
You can report a concern found through your normal authorized use or review of public source. This page does not authorize active testing of production services.
For active testing, first email the exact asset, account, methods, request volume, and proposed time window. Wait for a written reply that explicitly approves the scope. Silence and a public source license are not approval.
What to include
A short report is enough to start. Include what you can safely share:
- The affected product, URL, or version.
- What happened and the potential impact.
- Minimal steps using only accounts and data you own.
- Relevant timestamps or request IDs, with private data removed.
Do not email passwords, recovery phrases, private keys, raw personal records, or other sensitive material. If you encounter any, stop and report the circumstances without copying the material.
Protect people and services
Do not access other people's accounts or data, disrupt services, run broad scans, attempt credential attacks, use social engineering, alter or extract data, or contact third-party providers as part of a Voidly test.
Payment and wallet flows, real transactions, private messages and mail, VPN and control systems, and protected API paths are not open test targets. Ask for written approval before testing any uncertain boundary. Stop once you have the minimum evidence needed to describe a concern.
Disclosure and rewards
Please report privately and give us an opportunity to investigate before sharing exploit details publicly. Contact the security inbox to discuss disclosure timing.
No security reward amounts or eligibility rules are published. Sending a report does not create a payment entitlement. A paid program would require separately published scope and terms.
Voidpay has a separate security boundary. Its payment and private-data rules still apply.