Reporting a security issue
If you believe you have found a vulnerability in JPVerify, please tell us privately so we can fix it before it is disclosed.
How to report
Email service@jpverify.com with the subject line starting “Security:”. We read reports in English, Chinese and Japanese.
What to include
- The affected URL or API endpoint, and the request ID (x-request-id response header) if you have one
- Steps to reproduce, and what you expected versus what happened
- The impact you believe the issue has
- How we can contact you for follow-up questions
Scope
jpverify.com and api.jpverify.com, including the x402 payment flow. Issues in third-party services we use (for example Cloudflare, Base or Coinbase) should be reported to those providers.
Please
- Test only against your own requests and data; do not access, modify or delete other people’s data
- Do not run denial-of-service, load or spam tests
- Do not use social engineering or physical attacks
- Give us reasonable time to fix the issue before sharing details publicly
For security tools
The machine-readable contact file (RFC 9116) is at https://api.jpverify.com/.well-known/security.txt