Rubean
Report a Vulnerability

Rubean Security

Vulnerability Disclosure Policy

As a provider of software point-of-sale payment solutions, the security and integrity of our applications and infrastructure are core priorities. This policy outlines how security researchers can report potential vulnerabilities to Rubean and how we evaluate and resolve those reports.

1. Scope

This policy applies to Rubean’s Mobile Payments on COTS (MPoC) products and supporting payment infrastructure operated by Rubean.

In-Scope Systems & Products

Component Description
Mobile Applications Rubean PhonePOS / SoftPOS mobile applications distributed for Android and iOS devices.
Software Development Kits (SDK) PhonePOS payment acceptance SDKs and client libraries integrated into partner and merchant applications.
Backend & Attestation Services Production APIs, transaction processing services, cryptographic key management, and device/software attestation backends operated by Rubean.
Web Properties Official Rubean web domains and merchant/partner portals under *.rubean.com.

Out of Scope

  • Denial-of-service (DoS/DDoS) attacks, resource exhaustion, or automated high-volume scanning against production endpoints.
  • Social engineering, phishing, or physical security testing targeting Rubean personnel, offices, or data centers.
  • Third-party acquiring networks, card scheme infrastructure, or external service providers not operated by Rubean.
  • Reports generated solely by automated scanners or static analysis tools without a verifiable proof of concept demonstrating practical exploitability.

2. Submitting a Report

Please send vulnerability reports by email to security@rubean.com. Because reports may contain sensitive technical details, please encrypt your message and any attachments using our PGP public key.

To help our engineering team reproduce and evaluate your finding quickly, please include:

  • Affected component and version: Application package name, app/SDK version number, operating system version, or specific API endpoint/URL.
  • Technical description: Nature of the vulnerability and the conditions required to trigger it.
  • Reproduction steps: Clear step-by-step instructions, request/response samples, or minimal proof-of-concept code necessary to reproduce the issue.
  • Security impact: Your assessment of what an attacker could achieve by exploiting the issue.

Reports may be submitted in English or German. You may submit reports anonymously, though providing a contact address allows us to follow up if clarification is needed and to notify you when remediation is complete.

3. Evaluation & Response Process

Every vulnerability report is reviewed by Rubean’s security and engineering teams according to our internal risk management and software update procedures:

Stage Target Timeline Activity
Acknowledgment Within 2 business days Confirmation of receipt and assignment of an internal tracking reference.
Triage & Assessment Within 5 business days Reproduction of the reported issue, determination of scope, and severity scoring (CVSS).
Remediation Based on severity Development, verification, and rollout of patches across affected mobile applications, SDK releases, or backend services.
Resolution Upon deployment Notification to the reporter that the fix has been deployed and coordination on any planned disclosure.

4. Research Guidelines

When investigating potential vulnerabilities, we ask that you act in good faith and adhere to the following rules:

  • Do not access, store, modify, or delete data belonging to merchants, cardholders, or other third parties.
  • If you inadvertently encounter sensitive payment, personal, or confidential data during your research, cease testing immediately and report the finding to us so we can investigate safely.
  • Do not perform testing that degrades, disrupts, or impairs the availability or integrity of Rubean production services.
  • Do not publicly disclose details of a suspected vulnerability before Rubean has confirmed that remediation and rollout are complete.

5. Safe Harbor

Rubean supports independent security research conducted in good faith. If your testing and reporting comply with the scope and guidelines set out in this policy:

  • We consider your security research to be authorized concerning applicable anti-circumvention and computer misuse laws.
  • We will not initiate or support civil or criminal legal action against you in connection with your research and report.
  • If legal action is initiated by a third party regarding activities you conducted in accordance with this policy, we will take steps to make known that your actions were conducted pursuant to our Vulnerability Disclosure Policy.

Please note that Rubean operates a Vulnerability Disclosure Program and does not currently offer financial bug bounty rewards unless explicitly agreed in writing prior to testing.