numra/numra-php holds a credential that reads a shared fraud ledger and
spends a merchant's paid quota. A weakness in it is worth something to the
people the ledger exists to describe, so please treat one accordingly.
| Version | Supported |
|---|---|
| 1.0.x | Yes |
1.0.0 is the first public release, so there is nothing older to support. When a later major line opens, this table will say how long 1.x keeps receiving security fixes.
Mail security@numra.ma. Put the package name in the subject.
Do not open a public issue, pull request or discussion for a security problem. A public report is a working exploit for every merchant running the released version until a fix ships, and the fix takes longer than the reading.
Useful to include:
- the package version and the PHP version;
- what an attacker can do, and what they need in order to do it;
- the smallest reproduction you can manage.
Please do not send a live API key, a webhook secret, or a real customer's phone number. A rotated test key and an invented number make the same point.
- An acknowledgement within three working days.
- An assessment, and either a fix or an explanation of why we do not consider it one, within ten working days.
- A fixed release, an entry in CHANGELOG.md, and a published advisory once merchants have had a chance to upgrade.
- Credit under whatever name you want, or none.
We will ask you to hold public disclosure until the fixed release is out. We will not ask you to hold it indefinitely.
Anything that lets a caller bypass the authorize rule in Numra\Handlers;
anything that puts the API key or webhook secret into a response, a log line
or an exception message; anything that defeats or weakens webhook signature
verification, including the constant-time comparison, the replay window and
the case-insensitive header lookup; anything that widens what Handlers hands
back to the browser beyond the narrowed check.
Findings that require a merchant to have already published their own API key, an unrated endpoint on an application that never added the rate limit the README asks for, missing hardening headers on the surrounding application, and reports generated by a scanner without a reproduction.
If the finding is in the Laravel wiring rather than in this client, it belongs to numra-laravel — mail it to the same address either way, and open a public issue in neither.