Partial capture endpoint
past findings for partial capture endpoint
We fund research into making the web safer.
The Enclave Research Fellowship gives independent security researchers $1,000 every month to use for research on Enclave. You find vulnerabilities in critical software and disclose them properly, and we publish the research, credited to you.
Run r_7c1e
Chat · Hunt the payments APIby Alex Rivera
Input · northwind/payments-api · 32 attack surfaces
Select surfacesSurface selector
Attack surfaces · 32 records
Webhook signature verification
past findings for webhook signature verification
Refund approval
past findings for refund approval
Merchant API keys
past findings for merchant api keys
Statement export
past findings for statement export
Card tokenization
past findings for card tokenization
Support impersonation
past findings for support impersonation
Payout destination change
past findings for payout destination change
Dispute evidence upload
past findings for dispute evidence upload
3-D Secure callback
past findings for 3-d secure callback
Payment links
past findings for payment links
Checkout session lookup
past findings for checkout session lookup
Idempotency keys
past findings for idempotency keys
Batch transfers
past findings for batch transfers
FX quote lock
past findings for fx quote lock
KYC document upload
past findings for kyc document upload
Merchant onboarding
past findings for merchant onboarding
OAuth connect
past findings for oauth connect
Session refresh
past findings for session refresh
Password reset
past findings for password reset
MFA enrollment
past findings for mfa enrollment
SAML SSO
past findings for saml sso
SCIM provisioning
past findings for scim provisioning
Audit log export
past findings for audit log export
GraphQL gateway
past findings for graphql gateway
Invoice PDF rendering
past findings for invoice pdf rendering
Subscription coupons
past findings for subscription coupons
Ledger adjustments
past findings for ledger adjustments
API rate limiter
past findings for api rate limiter
Webhook endpoint registration
past findings for webhook endpoint registration
Partial refunds
past findings for partial refunds
Card vault export
past findings for card vault export
ResultNot yet
The fellowship
Funding every month, credit for every finding.
We give each fellow $1,000 every month to use for research on Enclave, and we publish what they find.
Funding every month
Each fellow gets a login and $1,000 every month to use for research on Enclave, putting its fleet of autonomous agents to work on critical software.
Proper disclosure
The vendor hears first and gets the full 90 day window to ship a fix before anything is published.
Credit for your findings
Once the window closes, we publish your research at enclave.ai/research with your story, your approach and a proof of concept, credited to you.
Who it’s for
Researchers with work to show.
We’re looking for independent security researchers with published CVEs who want to spend serious time on the software the web depends on.
Space is limited to 10 researchers. Our research team reviews every submission before we finalize the program.
How it works
Your research. Your credit.
Research happens within the rules of an authorized bug bounty or vulnerability disclosure program and the law. Enclave does not authorize testing of any target.
Apply with your CVEs
Share your name, your email and links to three published CVEs. You’ll hear from us within two weeks.
Research on Enclave
If you’re accepted, you get $1,000 every month to use for research on Enclave, and send us product feedback each month while your research waits out the disclosure window.
Disclose, then publish
Report what you find to the vendor and give them the full 90 day window. Then share the research with us, and we publish it, credited to you.
Let’s work together
What have you found?
Apply to the Enclave Research Fellowship with links to three published CVEs.
Tell us anything else we should know. We’ll take it from there.