How to report

• Email security@biya.com.ng. Plain email is fine; we do not use PGP or a submission portal.
• Include:
  • the product and the URL or endpoint affected;
  • the steps to reproduce it;
  • what an attacker could do with it;
  • the account or accounts you used to test, with dates and times.
• We will acknowledge your report within 48 hours and keep you updated while we work on it.

What is in scope

• biya.com.ng and its subdomains, including Biya Business (business.biya.com.ng) and Biya Merchant (merchant.biya.com.ng).
• BiyaBot on Telegram, Slack, Messenger and the web.
• Biya's public APIs and partner integrations.

What is out of scope

• Denial of service, load or volume testing.
• Social engineering of Biya staff, customers or partners, and physical attacks.
• Vulnerabilities in third-party services we use (report those to the provider).
• Automated scanner output without a demonstrated, exploitable impact.
• Missing security headers, cookie flags or rate limits where you cannot show a real impact.
• Self-XSS, and clickjacking on pages with no sensitive action.

Rules for testing

• Test only with accounts you own or have explicit permission to use.
• Do not access, change, download or keep anyone else's data. If you reach someone else's data by accident, stop, do not keep it, and tell us in your report.
• Do not move other people's money. Keep any payment testing to small amounts in your own account.
• Do not send bulk or automated traffic, and do not trigger real airtime, data, bill or payout transactions beyond what is needed to show the issue.
• Give us reasonable time to fix the issue before you share it with anyone, and agree a disclosure date with us.

Safe harbour

If you follow this policy in good faith, we will treat your research as authorised, we will not take legal action against you for it, and we will work with you to understand and fix the issue quickly.