Last updated: 29 October 2026

Astro Africa (ASTRO DIGITAL MANAGEMENT LIMITED, RC 2016680) takes the security of our customers’ money and data seriously. If you believe you have found a security vulnerability in Astro, we want to hear from you. This policy explains what to report, how to report it, and what we expect from you while testing.

Go ahead and attack us

You’re welcome to attack the Astro Africa apps, website and API and try to break in. If you find a way in, report it to us and you can still be rewarded.

Where to report

Email [email protected] with the subject line “Vulnerability report”.

Please include:

• A clear description of the issue and where it is (URL, API endpoint, app screen, app version).
• Step-by-step instructions to reproduce it.
• The impact: what an attacker could do with it.
• Proof of concept, screenshots or a short video, if you have them.
• How we can contact you.

Please do not report vulnerabilities through social media, app reviews or live chat.

What’s in scope

• The Astro Africa mobile apps (Android and iOS)
• The Astro Africa website and web app
• The Astro Africa API

We’re interested in any issue that could put our customers’ accounts, funds or personal data at risk. Please explain the real-world impact clearly in your report.

What’s out of scope

Please do not report:

• Missing security headers or cookie flags with no demonstrated impact
• Clickjacking on pages with no sensitive actions
• Rate limiting on non-sensitive pages
• Self-XSS, or issues that need a rooted or jailbroken device
• Reports from automated scanners with no proof of impact
• SPF, DKIM or DMARC settings
• Outdated software versions with no working exploit
• Social engineering, phishing or physical attacks
• Denial-of-service or volume testing
• Issues in third-party services we use that are not caused by how we use them

What you can expect from us

• We’ll confirm we received your report within 3 working days.
• We’ll keep you updated while we investigate and fix it.
• With your permission, we’ll credit you once the issue is fixed.

This policy does not authorise any activity that breaks the rules above or the law.

Rewards

Valid reports that follow this policy may be eligible for a reward. Rewards depend on the impact of the issue and the quality of the report, and are decided by Astro Africa.

---

Thank you for helping keep Astro Africa and our customers safe.