Responsible Disclosure

1Purpose and Scope of This Policy

Noqoody Payment Services W.L.L. (“Noqoody”) takes the security of our systems and the data they hold very seriously. As a payment service provider licensed by the Qatar Central Bank, we process payments and cardholder data on behalf of merchants across Qatar, and we work continuously to keep that environment safe for everyone who uses it.

If you have discovered a security vulnerability affecting any Noqoody service, we appreciate your help in disclosing it to us responsibly. This policy sets out how to do that, what we commit to in return, and the boundaries within which testing is permitted.

2Our Commitments to You

Where you report a vulnerability in good faith and in accordance with this policy, Noqoody commits to:

1. Acknowledge receipt of your report promptly, and work to understand and resolve the issue quickly.
2. Validate, respond to and remediate confirmed vulnerabilities in line with our commitment to security and privacy, and in accordance with the severity model in section 9.
3. Keep you informed of progress at reasonable intervals, and notify you when the issue has been fixed.
4. Not pursue or support legal action against you, or against the person who reported the vulnerability, unless we are required to do so by law or by a competent authority.
5. Not suspend or terminate your access to our services if you are a merchant. If you are an agent or partner, we will not suspend or terminate access for the merchants you represent because of a good-faith report.
6. Respect your privacy. We will not publish your identity or your report without your consent, except where disclosure is required by law, by the Qatar Central Bank, or by another competent authority.
7. Credit your contribution where you wish to be named, in accordance with section 10.

3Safe Harbour

Noqoody will treat security research conducted in good faith and in full compliance with this policy as authorised conduct. Where you meet all of the conditions below, we will not initiate or support a complaint, claim or legal proceeding against you in respect of that research:

• You act in good faith and solely to identify and report a genuine security weakness.
• You stay strictly within the scope defined in section 4 and observe every rule in section 6.
• You stop testing immediately on discovering a vulnerability, or as soon as you gain access to any data that is not your own, and you report it to us without delay.
• You do not access, copy, modify, retain, transmit or disclose any personal data, cardholder data, credentials or confidential information beyond the minimum needed to demonstrate the issue — and you securely delete anything you did access once your report is submitted.
• You do not degrade, disrupt or damage our services, our merchants’ operations, or any third party.
• You do not exploit the vulnerability for personal gain, and you do not use it as leverage to demand payment.
• You give us a reasonable opportunity to remediate before any public disclosure, in accordance with section 11.

4What Is in Scope

Unless we tell you otherwise in writing, the following are in scope:

• Noqoody public websites and web applications operating on noqoody.com and its subdomains.
• The Noqoody merchant dashboard and merchant portal.
• Noqoody hosted checkout, payment links, QR payment pages and e-invoice pages.
• Noqoody public APIs and the Noqoody Mobile SDK.
• Noqoody mobile applications published under the Noqoody name on official app stores.

Vulnerability classes we most want to hear about

5What Is Out of Scope

The following are outside the scope of this policy. Reports limited to these will be acknowledged but are unlikely to be treated as qualifying findings.

5.1 Assets out of scope

• Systems, networks and applications belonging to our merchants, banking partners, card schemes, suppliers or any other third party — even where they integrate with Noqoody.
• Third-party services and platforms we merely consume, and any domain not operated by Noqoody.
• Physical premises, staff, and Noqoody-owned devices, other than as covered by section 6.

5.2 Findings that do not qualify

• Reports produced solely by an automated scanner, with no demonstrated exploitability or impact.
• Missing security headers, cookie flags, or TLS configuration preferences with no demonstrated exploit.
• Absence of rate limiting or CAPTCHA, and account or username enumeration, without a demonstrated material impact.
• Self-XSS, clickjacking on pages with no sensitive state-changing action, and issues requiring an unlikely degree of user interaction.
• Email configuration findings (SPF, DKIM, DMARC) in isolation, and reports of spam or phishing not originating from a Noqoody flaw.
• Disclosure of publicly available or non-sensitive information, software version banners, and directory listings without sensitive content.
• Vulnerabilities affecting only unsupported, end-of-life or outdated browsers, operating systems or app versions.
• Theoretical issues with no realistic attack path, and best-practice recommendations without an identified weakness.
• Findings that require a rooted, jailbroken or physically compromised device, or a compromised user account.

6Rules of Engagement

To remain within this policy and within safe harbour, you must not:

1. Access, alter, delete, exfiltrate or retain any data that does not belong to you — including personal data, cardholder data, transaction records, credentials, API keys or merchant data.
2. Test using a live payment card belonging to any other person, or attempt any transaction intended to move real funds. Use test cards and the Noqoody sandbox where available.
3. Conduct denial-of-service or distributed denial-of-service testing, stress testing, volumetric testing, or any activity that degrades availability or performance.
4. Send unsolicited automated traffic at a rate that could disrupt production services, and avoid noisy scanning against production entirely where a sandbox exists.
5. Perform social engineering, phishing, vishing or smishing against Noqoody staff, merchants, customers or suppliers.
6. Attempt physical intrusion at any Noqoody premises, or tamper with any POS terminal that is not lawfully in your possession.
7. Install malware, backdoors, persistence mechanisms, cryptominers or any tooling that remains on our systems after testing.
8. Pivot into internal networks or systems beyond the initial point of discovery, or escalate access further than necessary to prove the finding.
9. Publicly disclose, sell, trade, or share the vulnerability with any third party before it is resolved and section 11 has been satisfied.
10. Demand payment, threaten disclosure, or attach any condition to the release of information as a condition of reporting. Any such demand will be treated as extortion, will void safe harbour, and will be reported to the competent authorities.

7How to Report a Vulnerability

Report the identified issue to our security team by sending an email from your own registered email address to security@noqoody.com.

Submit one vulnerability per report. Where a chain of issues produces a single impact, describe the chain in one report. Your email should follow the structure below.

1. Vulnerability details

• Help us get an idea of what this vulnerability is about.
• Describe the vulnerability and its impact — what an attacker could actually achieve.
• Provide a proof of concept, or clear replication steps.
• Attach proof-of-concept scripts, screenshots, screen recordings or request/response captures.

2. URL / location of the vulnerability (optional)

• The exact URL, endpoint, API method, parameter, app screen or SDK function affected.
• The environment you tested — production or sandbox — and the date and approximate time of testing.

3. Reproduction steps

• Numbered, step-by-step instructions that let our team reproduce the issue from a clean state.
• Any prerequisites: account type, role, merchant configuration, browser, device or app version.
• The test account identifiers you used — never send a password belonging to another person.

4. Impact assessment

• What data or function is exposed, and to whom.
• Whether the issue affects a single account, a single merchant, or multiple merchants.
• Your view of the severity, with a CVSS v3.1 vector if you use one.

5. Suggested remediation (optional)

• Any fix, mitigation or configuration change you would recommend.

6. Your details

• Your name or handle, and how you would like to be credited — or that you prefer to remain anonymous.
• A contact email address we can reply to.
• Confirmation that you have read and complied with this policy, and that you have deleted any data accessed during testing.

8What Happens Next

Where a report reveals a matter we are required to escalate, we will notify the Qatar Central Bank, the National Cyber Security Agency, affected merchants, card schemes or other authorities as our regulatory and contractual obligations require. We will not name you in those notifications unless the law requires it or you ask us to.

9Severity and Remediation Targets

We classify confirmed findings using CVSS v3.1, adjusted for real-world exploitability and for the impact on payment integrity and cardholder data.

Targets are objectives, not contractual commitments. Where a fix depends on a third-party vendor, a card scheme certification cycle or a banking partner, remediation may take longer; we will tell you if that is the case.

10Recognition and Rewards

1. Noqoody does not operate a published bug bounty programme with fixed payouts. We may, entirely at our discretion, offer recognition or a reward for a report that is original, in scope, clearly reproducible, and of genuine security value.
2. Where a reward is offered, the amount is determined by Noqoody by reference to severity, quality of the report and real-world impact. Our determination is final.
3. Only the first reporter of a previously unknown issue is eligible. Duplicates, issues already known to us, and issues already identified in our own testing or by our auditors are not eligible.
4. Eligibility requires full compliance with this policy. Breaching section 6, or disclosing publicly before section 11 is satisfied, voids eligibility.
5. Current and former employees, contractors, suppliers and their immediate family members are not eligible.
6. Any reward is subject to applicable law, sanctions screening and tax obligations. We cannot pay individuals or entities in sanctioned jurisdictions.
7. With your consent, we will credit you by name or handle in our security acknowledgements.

11Coordinated Disclosure

1. Please give us a reasonable period to remediate before any public disclosure. Our default coordination window is 90 calendar days from the date we acknowledge your report.
2. Where a fix requires a third party, a scheme certification cycle or a coordinated merchant upgrade, we may ask you to extend the window. We will explain why, and we will not use extensions to avoid fixing an issue.
3. We are happy to coordinate the timing and content of any write-up with you, and to review a draft for accuracy and for anything that would put merchants at risk.
4. Any public write-up must not include cardholder data, personal data, credentials, internal system detail, merchant identities, or working exploit code that would put others at risk.
5. If we cannot fix an issue within the window, we will tell you, explain the interim mitigations in place, and agree a revised date with you.

12Contact

This policy is reviewed at least annually and may be updated at any time. The version in force is the one published on this page.