Security and vulnerability disclosure

How we protect our services

• Product codes are stored only as SHA-256 hashes. The plaintext codes exist only in the encrypted file delivered to the manufacturer.
• Each company’s data is isolated in the application and again by row-level security in the database.
• Two-step verification is required for company owners and admins, and for all CredChek staff.
• Privileged actions are written to an append-only audit log, including every support session opened by CredChek staff.
• API keys are shown once, stored as hashes, scoped to the permissions an integration needs, and can be revoked immediately.
• Webhooks are signed with HMAC-SHA256 and a timestamp to prevent forgery and replay.

Vulnerability disclosure policy

In scope

• The CredChek API at api.credchek.com and the sandbox at api.sandbox.credchek.com
• The company portal and the platform admin application
• The verification website
• The CredChek mobile apps
• Other services we operate on *.credchek.com

Out of scope

• Denial of service, load or volumetric testing of any kind
• Social engineering, phishing or any contact with CredChek staff, customers or consumers
• Physical attacks against offices, data centres or devices
• Services run by third-party providers (for example hosting, email, SMS or payment providers). Report those to the provider.
• Reports that only show a missing or reachable rate limit, without a demonstrated security impact
• Findings from automated scanners without a working proof of concept

Testing guidelines

• Use your own accounts and test data. The sandbox (cc_test_ keys) is the best place to test the API.
• Don’t access, change or delete data that isn’t yours. If you reach someone else’s data by accident, stop, don’t keep a copy, and tell us what you saw.
• Don’t try to generate, guess or collect valid product codes beyond what you need to demonstrate an issue.
• Don’t degrade the service for others, and don’t use automated tools at high volume.
• Give us reasonable time to fix an issue before telling anyone else about it.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised. We won’t take legal action against you or ask law enforcement to investigate you for it, and we will make this clear if a third party raises a complaint about your research. If you’re unsure whether something is allowed, ask us first at [email protected].

How to report

Email [email protected] with:

• the affected service, URL or app version
• clear steps to reproduce the issue and a proof of concept
• the impact you believe it has
• how we can contact you, and whether you would like to be credited

To encrypt your report, use our PGP key: [[PGP KEY FINGERPRINT AND URL]].

Rewards

We don’t run a paid bug bounty programme at the moment, so we can’t promise payment for reports. With your permission, we’re glad to thank you publicly once an issue is fixed.