Do not open a public issue for a security problem.

Report it privately via GitHub's private vulnerability reporting, or email tech@getpayin.com.

Please include the SDK version, your Java version, a description of the impact, and a reproduction if you have one. We aim to acknowledge within 3 business days.

The latest minor release receives security fixes. Because the SDK is pre-1.0, patches are published against the newest version only.

This SDK is server-side only.

• hashToken is a signing secret. It must never reach a browser, mobile, or desktop client. Anyone holding it can forge requests and webhooks for your integration.
• publicToken identifies the integration and is sent on every request. It is not secret, but it is not a substitute for the signing secret either.
• Load both from environment variables, paylink.* properties, or a secret manager. Never commit them.

PaylinkClient.toString() does not include the hashToken, so it stays out of logs and traces that render the client.

• Webhook replay protection. PayLink webhook signatures carry no timestamp or nonce, so a valid payload stays valid forever. Signature verification proves authenticity, not freshness. Pair webhooks().verify() with your own idempotency keyed on invoice_id.
• PCI scope reduction. vcc().charge and cards().tokenize accept raw PAN and CVV. Sending real card data through your server puts that server in PCI scope. Prefer the hosted checkout (invoices().create) or card tokens where possible.
• Error redaction. PaylinkApiException.raw() holds the API's response body verbatim so failures stay debuggable. If you forward errors to a third-party log or APM, review what that body can contain for your integration.