Razorpay

Vulnerability disclosure program on Self-hosted razorpay.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No We currently do not offer any monetary compensation.
Safe harbor: Full We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.
Hall of fame: Yes publicly acknowledge and recognise your responsible disclosure in our Hall of Fame page.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

5 assets you may test, 30 excluded.

Out of scope (30)

Any services hosted by 3rd party providers and services not provided by Razorpay
Any service that is not mentioned in the In Scope domains section
Cacheable SSL pages
Clickjacking and issues only exploitable through clickjacking
Disclosure of known public files or directories, (e.g. robots.txt)
DOM Based Self-XSS and issues exploitable only through Self-XSS.
Duplicate submissions that are being remediated
Email bombs
Fingerprinting / banner disclosure on common/public services
Forgot Password page bruteforce and account lockout not enforced
Formula Injection or CSV Injection
Gmail "+" and "." acceptance
HTTP 404 codes/pages or other HTTP non-200 codes/pages
IDOR references for objects that you have permission to access
Issues without clearly identified security impact such as missing security headers.
Known issues
Lack of Captcha
Missing CAA headers
Multiple reports for the same vulnerability type with minor differences (only one will be rewarded)
Networking issues or industry standards
Only session cookies needed http and secure flags. Apart from these, for other cookies we won’t consider as vulnerability
Open redirects
Password complexity
Patches released within the last 30 days
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
Rate limiting (Unless it implies severe threat to data, business loss)
Session Timeouts
SPF or DMARC records
Unsubscribing from marketing emails
Vulnerabilities requiring physical access to the victim's unlocked device.

What the policy asks of you, and the bug types it won't reward, quoted from Razorpay's policy. "We" in these lines means the program, not this site.

Make every effort to avoid privacy violations, degradation of user or merchant experience, disruption to production systems, and destruction of data during security testing.
Not attempt to gain access to any other persons account, data or personal information.
Use their real email address to signup and report any vulnerability information to us.
Keep information about any vulnerabilities you’ve discovered confidential between yourself and Razorpay.
The Researcher shall not publicly disclose the bug or vulnerability on any online or physical platform before it is fixed and prior written approval to publicly disclose from Razorpay.
Not perform any attack that could harm the reliability, integrity and capacity of our Services. DDoS/spam attacks are STRICTLY not allowed
Not use scanners or automated tools to find vulnerabilities (noisy and we may automatically suspend your account and ban your IP address)
Include a custom HTTP header in all your traffic with an ID. (Burp and other proxies allow easy automatic addition of headers to all outbound requests.)
Remember that you must never attempt non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure.
A Researcher can test only against a merchant account if they are an account owner or an agent authorised by the account owner to conduct such testing.

Price manipulation WITHOUT SUCCESSFUL TRANSACTION
IDOR references for objects that you have permission to access
Duplicate submissions that are being remediated
Known issues
Rate limiting (Unless it implies severe threat to data, business loss)
Multiple reports for the same vulnerability type with minor differences (only one will be rewarded)
Open redirects
Clickjacking and issues only exploitable through clickjacking
Only session cookies needed http and secure flags. Apart from these, for other cookies we won’t consider as vulnerability
Issues without clearly identified security impact such as missing security headers.
Missing CAA headers
Vulnerabilities requiring physical access to the victim's unlocked device.
Formula Injection or CSV Injection
DOM Based Self-XSS and issues exploitable only through Self-XSS.
Patches released within the last 30 days
Networking issues or industry standards
Password complexity
SPF or DMARC records
Gmail "+" and "." acceptance
Email bombs
Unsubscribing from marketing emails
HTTP 404 codes/pages or other HTTP non-200 codes/pages
Fingerprinting / banner disclosure on common/public services
Disclosure of known public files or directories, (e.g. robots.txt)
Cacheable SSL pages

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

CVE	Summary	Severity	Published
CVE-2024-10850	The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into	Medium 6.1	13 Nov 2024
CVE-2024-10851	The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing	Medium 6.1	13 Nov 2024

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake