Report a security vulnerability
If you believe you have found a vulnerability in a Ry.hk website, account, payment flow, or infrastructure, send us enough detail to reproduce and assess it. Please keep the report private while we investigate.
Do not publish exploit details or customer data before we have had a reasonable opportunity to investigate and respond.
What to report
- Authentication, authorization, account takeover, or payment bypass issues.
- Exposed customer, order, invoice, or personal data.
- Code execution, injection, SSRF, path traversal, or insecure file handling.
- Phishing or malicious content impersonating Ry.hk.
Include enough detail to triage
A clear, minimal reproduction is more useful than a video of many unrelated actions.
- The affected URL, feature, and type of account.
- Step-by-step reproduction steps and the observed result.
- The security impact and any preconditions you identified.
- Timestamps, request IDs, redacted screenshots, or logs that help verify the issue.
What happens next
Vulnerability reporting questions
Will my security report remain confidential?
We restrict the report to people who need it to investigate and fix the issue. Please do not publish exploit details or customer data before we have had a reasonable opportunity to assess and coordinate disclosure.
Do you offer a bug bounty?
We do not currently promise a public bug bounty or a cash reward for every report. We assess reports on impact and validity; no reward is implied unless it has been agreed with you in writing.
What should I avoid including or doing during testing?
Do not access another customer’s data, run destructive or high-load tests, or include passwords, private keys or unredacted personal information. A minimal reproduction and redacted evidence are enough.
Please test safely
- Use only accounts, domains, and data that you control.
- Do not degrade service, run destructive tests, or access another person’s data.
- Avoid automated scanning that creates unnecessary load or noise.
Keep the details private
If you cannot use email, open a support ticket and mark the subject as a security report.