Security
Report a security issue
Magic Suites & Villas is a small, family-run villa business in Koh Samui, Thailand, operated by หจก. ปากหวาน สมุย (Pakwan Samui Limited Partnership). We run our own website and direct booking pages, and we care about keeping our guests' details and payments safe. If you have found a weakness, we would like to hear about it.
How to reach us
Email info@magicsamui.com with “Security” in the subject line. It goes to the owner, who looks after our website and systems personally; we do not have a separate security team. For something urgent you can also message +66 95 246 6011 on WhatsApp.
Please include what you found, where (the page or address), and the steps to see it again. Screenshots help. Do not send us anyone else's personal details - a description is enough.
What is ours
- magicsamui.com and every page on it
- our direct booking pages and their payment step
- the automated replies of our WhatsApp assistant
Not ours, so please report these to their own teams: the Cloudbeds booking engine, the Beam and Stripe payment pages (card details are entered there and never reach our own systems), and our listings on Booking.com, Airbnb and other platforms.
Ground rules
- Test only with your own details and your own bookings.
- Do not look at, download or change other guests' information. If you come across it by accident, stop and tell us.
- Do not complete a real payment as part of a test - stop at the payment page and tell us what you found.
- No flooding, denial of service, automated mass scanning, or tricking our staff.
- Give us time to fix the issue before you share it publicly.
What we will do
- Reply within five working days to say we have received your report.
- Keep you informed while we look into it and fix it.
- Thank you publicly on this page if you would like us to.
We are a small business and do not run a paid bug-bounty programme, but we are genuinely grateful for reports made in good faith, and we will not take action against anyone who follows the rules above.
This information is also published in the standard machine-readable form at /.well-known/security.txt. Last updated 9 November 2026.