These libraries handle payments, so security reports are the highest priority.

Do not open a public issue.

Report privately through either channel:

• GitHub private vulnerability reporting, from the Security tab of the affected repository
• Telegram: @muhammadali_me

Please include the package and version, the framework and version, what an attacker can do concretely, and the smallest sample that demonstrates it. Redact merchant keys and card data.

You can expect acknowledgement within 72 hours and an assessment with a fix timeline within 7 days. Please allow a reasonable window before disclosing publicly. Credit in the release notes if you want it.

In scope: signature or authentication bypass in a webhook handler, amount, account or transaction-state handling that confirms a payment it should not, replay and idempotency failures that double-credit an account, and secrets leaking into logs or responses.

Out of scope: vulnerabilities in Payme, Click, Uzum, Paynet or Octo themselves — report those to the provider — and misconfiguration in an application using the library.

Repositories may add their own SECURITY.md; where they do, it takes precedence over this one.