Reporting a security problem

Last updated: 17 September 2026

If you have found a security weakness in Zoyn, thank you — please tell us. We will work with you to understand it and fix it. "Zoyn" means Zoyn Technologies Inc. (/legal/company-details).

How to report

Email: dev@zoyn.com Subject: "Security Vulnerability Report — [short description]"

Please include:

• a clear description of the problem;
• the web address or part of Zoyn affected;
• step-by-step instructions to reproduce it;
• what an attacker could do with it;
• any proof-of-concept code, screenshots, or video; and
• whether you tested on our live service or a test environment.

What we promise you

When you report a problem to us in good faith, we will:

1. tell you we have got it, within 3 working days;
2. tell you whether we accept it, need more information, or think it is out of scope, within 10 working days;
3. keep you reasonably updated while we fix accepted reports;
4. not intend to take legal action against good-faith research that follows the rules below; and
5. credit you — by name or a nickname, as you prefer — in any public write-up, if you want to be credited.

For problems we accept, we aim to fix serious ones within 30 days and the rest within 90 days, and we will keep you posted on how it is going.

The rules — what you must not do

To be covered by this page, you must not:

1. access, change, or delete anyone else's data;
2. attempt a denial-of-service attack;
3. send unsolicited emails, messages, or phishing attempts to Zoyn users;
4. test our live service in ways that slow it down or expose user data — use test accounts wherever you can;
5. make the problem public before we have had a fair chance to fix it (see below);
6. use the problem to access, copy, or keep more data than you need to show it exists; or
7. break any law while doing your research.

If you break these rules, Zoyn keeps all its legal rights.

Going public

Please do not tell the public or anyone else about the problem until we have fixed it, or until 90 days have passed since you first told us — whichever comes first. Talk to us about the timing and we will work it out with you.

After those 90 days you are free to publish, whether or not we have finished fixing it. There are only two exceptions:

• we can show you the problem is being actively exploited right now, and publishing would cause immediate harm; or
• you and we have agreed in writing to wait longer.

What is covered

• The Zoyn API (/api/*)
• The merchant dashboard (app.zoyn.com)
• The Zoyn admin portal (admin.zoyn.com)
• The Zoyn website (zoyn.com)
• The Zoyn status page (zoyn.com/status)
• The payment page a shopper sees on a shop's own web address (pay.<shop>.com) — that page is run by Zoyn, so it is ours to fix, even though it does not carry our name

Not covered:

• other companies' services (thirdweb, Clerk, AWS, and others) — please report those to them directly;
• weaknesses in the Base blockchain or smart-contract infrastructure;
• social engineering or phishing of Zoyn staff;
• physical attacks;
• automated scanner results you have not checked by hand; and
• denial-of-service attacks.

No cash rewards

We do not run a paid bug-bounty program at the moment. For significant findings we may, at our discretion, offer recognition such as a public credit.

The legal position

This page does not give permission to access any system or data beyond your own test account. It is a good-faith statement of how we intend to respond — not a legal safe harbor, waiver, or immunity from the law. We look at each report individually, and whether you followed this page is something we take into account in deciding how to respond.