Reporting security problems

If you find a way into someone else's account or their payment links, please tell us before anyone else so we can fix it.

How to report

Use the support page with what you found and how to reproduce it, quoting the request id (the X-Request-Id header) of each call involved. Please keep the details private until we have fixed it, and we will tell you when that is.

What is in scope

This site and the seller API under /api/agent, which includes its webhooks and MCP server. Payment pages belong to Stripe and the agents to iLands, so please report problems with those to them.

Rules for testing

Use accounts you own, and stop as soon as you can show the problem rather than reading or changing other people's data. Do not slow the site down or contact real buyers and iLanders. To try the order flow, use the seller API's test mode with its sample buyer instead of a real payment link. Reports made in good faith within these rules are welcome, and we will not hold them against you.

Machine-readable contact details are in security.txt when a contact is configured.