Onpay Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
source: https://onpay.com/security/
policy: []
policy_page: https://onpay.com/security/
contact:
- security@onpay.com
intake: email
published_statement: >-
  "Want to report a security concern? Send us an email at security@onpay.com and our team will
  investigate promptly."
bug_bounty:
  program: null
  platform: null
  note: No HackerOne, Bugcrowd, or Intigriti program was found for OnPay.
security_txt:
  present: false
  probes:
  - url: https://onpay.com/.well-known/security.txt
    http_status: 404
  - url: https://help.onpay.com/.well-known/security.txt
    http_status: 404
  - url: https://app.onpay.com/.well-known/security.txt
    http_status: 301
    note: redirects to the application login, not a security.txt
  - url: https://api.onpay.com/.well-known/security.txt
    http_status: 301
    note: redirects to the application login, not a security.txt
gaps:
- No RFC 9116 /.well-known/security.txt, so the security contact is only discoverable by a human
  reading the marketing site.
- No formal responsible-disclosure or safe-harbor policy is published — only an email address.
- No bug bounty or coordinated-disclosure program.
evidence:
- source: https://onpay.com/security/
  kind: security-page
  http_status: 200
  keywords: [security@onpay.com, report a security concern, SOC 2 Type II]
  fetched: '2026-08-04'
note: >-
  The automated probe (0-working/probe-security-programs.py) recorded no hit for OnPay because
  onpay.com answers 403 to a non-browser user agent. The page was confirmed manually with a browser
  user agent and returns HTTP 200; this file is method: searched on that verified fetch.