Living in Thailand
Your first week in Thailand, without the admin scramble.
A calm order for the practical jobs that make everything else easier: your address, phone, transport, home records and first local routines.
Saurabh23 August 2026
Security and protection
Found something? Tell us.
We read every credible report, we answer, and we will not come after you for looking.
How to report
What to send us.
The more of this you include, the faster it gets fixed.
Where it is
The URL, endpoint or screen, and which environment you were on.
How to reproduce it
Steps, in order, that we can follow. A short recording is welcome; a proof-of-concept is better than a description.
What it lets someone do
Your read on the impact. We would rather have your honest assessment than a severity rating.
How to credit you
A name or handle if you would like acknowledgement, or tell us you would rather stay anonymous.
Scope.
| In scope | Out of scope | |
|---|---|---|
| Systems | paydeck.th and its subdomains, the Paydeck iOS and Android apps, and our public APIs | Third-party services we use, unless the issue is in how we configured them |
| Issue types | Authentication and authorisation flaws, payment logic errors, data exposure, injection, account takeover | Missing best-practice headers with no demonstrated impact, rate-limit noise, self-XSS, outdated library versions with no working exploit |
| Reports | A working reproduction against your own test account | Automated scanner output pasted without triage, and anything touching another person's data |
Ground rules
Testing we can defend.
Use your own account
Never access, modify or store another person's data. Stop as soon as you can prove the issue.
Do not degrade the service
No denial of service, no load testing, no spam to real users, no social engineering of our staff.
Give us time
Tell us privately first and allow a reasonable window before publishing anything.
What we promise in return.
We acknowledge
Within 3 business days
A human replies confirming we have your report.
We triage and tell you
Within 10 business days
You get our assessment, including if we disagree, and why.
We fix and credit
Severity-dependent
You hear when it ships, and you are credited if you want to be.
Safe harbour: if you follow these rules, act in good faith and report to us privately, we will not pursue legal action against you for your research.
One thing we ask you never to send
Do not include real card numbers, identity documents, bank account numbers or anyone else's personal data in a report: not as evidence, not as an attachment. Describe what you could reach and we will verify it ourselves. Redact everything else.
Paydeck does not currently run a paid bounty programme. We credit researchers publicly with their consent, and we answer every credible report.
security@paydeck.th
Encrypted reports welcome. Please include steps to reproduce.