Security contact

Report safely

Email security@startaps.org with “StarTaps security report” in the subject. Include the affected page or feature, approximate time and timezone, expected behavior, observed behavior, and the minimum reproduction steps. Do not access another customer’s data or continue testing after confirming a vulnerability.

Never send

Do not email passwords, MFA codes or seeds, API keys, webhook secrets, database credentials, full payment-card details, government identity documents, raw customer exports, complete shipping addresses, or copied private data. Redact customer and provider identifiers whenever possible.

StarTaps controls

• Server-side authentication, authorization, tenant isolation, and administrator MFA.
• Signed and idempotent payment webhooks with fail-closed commerce controls.
• Restricted security headers, input validation, private storage, and bounded upload types.
• Privacy-preserving rate limits, constrained error logs, secret scanning, and protected source review.
• Mandatory production, redirect, analytics, and physical-device QA before shipment.

Response commitment

A formal response target, disclosure process, safe-harbor statement, and vulnerability-reward policy have not been approved. StarTaps will preserve a report, limit access, investigate proportionately, and communicate through the verified contact method once the operational procedure is approved.