Responsible Disclosure

Our commitment

Van Tech Systems LLC, the operator of OneTap Digital Card, welcomes good-faith security research. We will not pursue legal action against researchers who follow this policy.

Scope

• The OneTap Digital Card application and API.
• The marketing website and authentication flows.
• Webhook handlers and payment integrations operated by Van Tech Systems LLC.

What we ask

• Give us reasonable time to investigate and remediate before public disclosure.
• Do not access, modify, or destroy data that is not your own.
• Do not perform testing that could degrade service for other users.
• Do not use social engineering, physical attacks, or denial-of-service attacks.

How to report

Email security@onetap.app with a clear description of the issue, steps to reproduce, and any proof-of-concept material. We aim to acknowledge reports within two business days.

Recognition

With your permission, Van Tech Systems LLC is happy to credit researchers who responsibly disclose qualifying vulnerabilities.