Living in Thailand
Your first week in Thailand, without the admin scramble.
A calm order for the practical jobs that make everything else easier: your address, phone, transport, home records and first local routines.
Saurabh23 August 2026
Security and protection
Found something? Tell us.
We read every credible report, we answer, and we will not come after you for looking.
How to report
What to send us.
The more of this you include, the faster it gets fixed.
Where it is
The URL, endpoint or screen, and which environment you were on.
How to reproduce it
Steps, in order, that we can follow. A short recording is welcome; a proof-of-concept is better than a description.
What it lets someone do
Your read on the impact. We would rather have your honest assessment than a severity rating.
How to credit you
A name or handle if you would like acknowledgement, or tell us you would rather stay anonymous.
Scope.
In scopeOut of scope
Systemspaydeck.th and its subdomains, the Paydeck iOS and Android apps, and our public APIsThird-party services we use, unless the issue is in how we configured them
Issue typesAuthentication and authorisation flaws, payment logic errors, data exposure, injection, account takeoverMissing best-practice headers with no demonstrated impact, rate-limit noise, self-XSS, outdated library versions with no working exploit
ReportsA working reproduction against your own test accountAutomated scanner output pasted without triage, and anything touching another person's data
Ground rules
Testing we can defend.
Use your own account
Never access, modify or store another person's data. Stop as soon as you can prove the issue.
Do not degrade the service
No denial of service, no load testing, no spam to real users, no social engineering of our staff.
Give us time
Tell us privately first and allow a reasonable window before publishing anything.
What we promise in return.
Safe harbour: if you follow these rules, act in good faith and report to us privately, we will not pursue legal action against you for your research.
One thing we ask you never to send
Do not include real card numbers, identity documents, bank account numbers or anyone else's personal data in a report: not as evidence, not as an attachment. Describe what you could reach and we will verify it ourselves. Redact everything else.
Paydeck does not currently run a paid bounty programme. We credit researchers publicly with their consent, and we answer every credible report.
We would rather hear it from you
Report it in good faith and you are safe with us
We will not pursue you for research that follows the rules on this page, and we will tell you what happened to your report.
security@paydeck.th
Encrypted reports welcome. Please include steps to reproduce.