Please do not open a public issue for security problems. Email cyrus@pastelero.ph with the details, or use GitHub's private vulnerability reporting. You should receive a response within 72 hours.
Only the latest released version receives security fixes.
- API credentials are read from constructor arguments or the
AIRWALLEX_CLIENT_ID/AIRWALLEX_API_KEYenvironment variables — never hardcode them. - The SDK redacts credentials and bearer tokens from
repr(), pickling, and exceptions. Avoid logging rawhttpxobjects you obtain by other means. base_urlmust be HTTPS (plain HTTP is allowed only for localhost mocks).- Webhook handlers must verify signatures with
airwallex.webhooks.construct_eventusing the raw request body; replay protection rejects stale timestamps.