Security

Reporting a vulnerability

Where to send it, what to include, and our commitment not to pursue good-faith research.

Send security reports to security@afer.app. It is one address, read by the people who can fix the problem. Write it in plain language; a working proof is worth more than a long write-up. You get a reply confirming we have it and one person as your contact until the issue is closed. If email is not an option, the support request form on this site works too.

• what you found, and what someone could do with it
• where it lives: the address, the app and its version, the platform
• the steps to reproduce it, in order
• screenshots, a short recording, or the requests and responses
• the name or handle you want credited, or none at all

If you research in good faith and stay inside the scope below, we will not pursue legal action against you for the testing, ask anyone else to, or report you for it. We will confirm that in writing if you need it. Good faith means you use your own accounts, take only the data needed to prove the finding, stop as soon as you have proof, and give us time to fix it before you publish.

That promise ends where research ends. Extortion, threats, selling a finding, changing or deleting other people's data, and using an account you broke into are not research, and we treat them as fraud. We also cannot speak for anyone else. If your testing touches a service we do not run, that provider's rules apply. Tell us anyway and we will pass on what we can.

Scope

Which apps, domains and APIs are in scope, and what is out of scope.

In scope: afer.app and the pages served under it, the Afër app on iOS and Android, the merchant app, the driver app, and the public API behind all of them. If an ordinary user, merchant or driver can reach it, we want to hear about it. That includes the parts of the site that take input from you, such as the support request form, the consent banner and the language cookie.

• social engineering of our staff, merchants, drivers, couriers or users
• physical attacks on offices, vehicles, devices or people
• denial of service, load testing, or anything that degrades the live service
• reports that are only automated scanner output, with no demonstrated impact
• services we do not operate, including the app stores and our payment processor

Test against your own accounts and your own data. Do not place a real order, request a real ride, or book an inspection to prove a point, and do not push a live merchant into work that costs them money. Do not read another person's chat, receipt or trip record; masked phone numbers stay masked. If a finding can only be shown with someone else's data, stop there and describe it, and we will set up a test account with you.

Response times

Acknowledgement, triage and fix targets.

We acknowledge every report sent to security@afer.app within two business days, and we finish triage within five. Triage gives you three things: a severity, a decision on whether the finding is in scope, and the name of the person handling it. If we cannot reproduce the issue we say so and ask what we missed, rather than closing it quietly. Duplicates are acknowledged too, and we tell you which report arrived first. The times below are the targets we work to, not guarantees.

• critical, such as account takeover or money moving without consent: contained at once, fixed within seven days
• high: fixed within thirty days
• medium: fixed within ninety days
• low: fixed in a regular release, and we tell you which one
• any target we are going to miss: we tell you before it passes, with a new date

These clocks are separate from the ones support runs on. Support aims to answer safety reports within the hour, day or night, payments and refunds the same business day, and everything else within one business day. If what you found is putting a specific person in danger right now, do not wait in the security queue. Use SOS in the app or write to support@afer.app and say it is urgent.

Account security

Phone verification, session handling, and what we will never ask you for.

Your account is tied to your phone number. Signing in sends a one-time code to that number, and a new device needs a fresh code before it sees anything. Sessions stay open on the devices you have already approved, so it is worth knowing which phones those are. Deleting the account from Settings closes those sessions with it, and removes your profile and personal data.

• the one-time code sent to your phone, ever, for any reason
• a password, because the account does not use one
• your full card number, in chat, in email or on a call
• a payment to release a refund, a payout or a wallet balance
• remote access to your phone, or a screen share of your wallet

Anyone who asks for one of those is not us, whatever the caller ID or the logo says. Real support reaches you through Help in the app, through support@afer.app, or as a reply to a request you opened on the site, carrying the reference code you were given. If someone calls claiming to be Afër and asks for your code, end the call and tell us.

Tell us quickly if you lose the phone, lose the number, or see a payment you did not make. We can suspend an account while we look, and payment problems are answered the same business day. Confirmed fraud sets that profile's trust score to zero and closes the account. The score is built from verification, completed transactions, ratings, account age and passed inspections, and the account holder cannot edit it.

Payment security

How wallet balances and card top-ups are handled, and the single-use QR design.

The wallet is prepaid, and every service settles from the same balance. That is a deliberate limit: the most anyone can reach through the app is what you have loaded, not the bank account behind it. Card top-ups run through our payment processor. Money you loaded can only go back to the card it came from, never to a bank account or another card, and earnings are paid only to the earner's own registered bank account, never to an account someone hands you in a chat.

Payment in person at a counter uses a single-use QR code shown in the merchant app. The code carries one payment, for that amount, and it is spent once it is used, so a photo of the screen is worth nothing afterward. Nobody working through Afër may ask you for money outside the app: where cash at the door is accepted, you hand over exactly the amount the app shows, and nothing more.

Every payment leaves an itemized receipt in the wallet, with the fee shown separately, so a charge you do not recognize is easy to spot. You have 14 days from an order, ride or purchase to open a dispute, and no deadline at all for a safety report or for money we are still holding. While a case is open the amount is held, not settled, and refunds return to the wallet balance they came from, usually within minutes of a decision.

Data protection

Encryption in transit and at rest, access control and audit logging.

Traffic between your device and Afër is encrypted in transit, and what we hold is encrypted where it is stored: account details, transaction records, device information, support messages, and the location we collect while a service is running. Location collection stops when the service stops. We keep personal data out of web addresses and out of anything that would otherwise land in a routine log.

Inside Afër, access is granted by role and by need. An agent handling your case sees the order, ride or listing attached to it, not your card details and not a colleague's cases. Access to systems holding personal data is logged and the logs are reviewed. An employee who opens a record they had no reason to open is handled as a security incident, not as an oversight.

• export everything you have given us, in a machine-readable file
• delete the account from Settings, and the profile and personal data with it
• transaction records the law requires us to keep stay, without your contact details
• analytics cookies on afer.app are set only after you choose Accept
• afer_lang stores a two-letter language code and is not used for analytics

A web form submission is stored with a reference code, the time, the approximate country it came from, and the IP address, which we use to prevent abuse. We may put Cloudflare Turnstile in front of a form to tell people from bots. A submission is kept as long as we need it to handle your request, and for up to 24 months after that.

Hall of thanks

Researchers who have reported responsibly.

We credit researchers who report responsibly, with their consent and never without it. Tell us in your report how you want to appear: a name, a handle, a company, or nothing at all. You can change your mind later and we will take the entry down. We do not promise payment for a report, and we will not hold a credit back because a finding was embarrassing for us.

• the name or handle the researcher chose
• the month the report reached us
• the kind of issue, described without a recipe for repeating it

The list is open and it starts empty. It fills as people report, and an entry goes up once the fix has shipped and the researcher has agreed to the wording. If you reported something and you are missing from the list, or you are on it and want off, write to security@afer.app and we will correct it within one business day.