Vulnerability disclosure
If you have found a security problem in anything of ours, please tell us. Here is exactly what happens next.
We will not pursue you
If you find and report a problem in good faith, we will not bring legal action against you, and we will not ask anyone else to. That holds even if you accessed data you should not have been able to reach — provided you stopped as soon as you understood what you had, did not keep it, and told us.
We would rather know. A company that makes reporting risky ends up with problems that are found by people who do not report them.
What we will do, and when
- Acknowledge within 3 working days. A person, not an autoresponder. We are a small team in India; if you write on a Friday evening you will hear back early in the week.
- Tell you what we think within 10 working days — whether we have reproduced it, whether we agree on the impact, and roughly when we expect to fix it.
- Tell you when it is fixed, and credit you by name if you would like that. If you would rather not be named, we will not name you.
There is no bounty
We do not pay for reports. We would rather say that plainly than let you spend a weekend on something in the hope that we might — implying payment and then declining is how these relationships turn adversarial.
In scope
- cyberrakshak.ai and its subdomains
- app.cyberrakshak.ai and api.cyberrakshak.ai
- The Windows desktop application
- The Android application
Out of scope
- Denial of service, load testing, or anything that degrades the service for other people
- Social engineering of our staff, customers or suppliers
- Physical attacks, or access to premises
- Reports generated solely by an automated scanner, with no demonstrated impact
- Missing security headers or weak TLS configuration with no exploitable consequence
What helps us most
Enough detail to reproduce it — a request, a sequence of steps, or a short script. If it involves data that is not yours, describe what you saw rather than sending it to us.
Please give us a reasonable chance to fix it before publishing. There is no fixed embargo: tell us what you intend and we will tell you honestly whether we can meet it.