Please do not open a public GitHub issue for security vulnerabilities.

To report a security issue, open a GitHub Security Advisory (private disclosure). You can also use the "Report a vulnerability" button on the Security tab.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Affected versions
• Any suggested fix, if you have one

• Acknowledgement within 48 hours
• Assessment and triage within 5 business days
• Fix and advisory published after a patch is ready (coordinated disclosure)

This policy covers the awesome-python-checkout PyPI package. It does not cover third-party dependencies — please report those directly to their respective maintainers.

• Never commit provider credentials (client_id, client_secret, mac_key, private_key) to source control.
• Rotate keys and secrets immediately if you suspect they have been exposed.
• Keep the library updated to receive security patches (pip install --upgrade awesome-python-checkout).
• Always validate webhook signatures in production (all built-in providers do this automatically).
• Use HTTPS in production to protect payment data in transit.