Vulnerability disclosure policy

Scope

This policy covers websites and services operated by HEBTECH Cyber Securities Services (OPC) Private Limited, including:

• www.hebtech.in and hebtech.in
• any other subdomain of hebtech.in that we operate

Services we use but do not operate, such as our email or hosting providers, are out of scope. Please report issues in those directly to the vendor concerned.

How to report

Email security@hebtech.in with:

• a description of the issue and where you found it;
• the steps or raw HTTP requests needed to reproduce it;
• the impact you believe it has;
• whether, and how, you would like to be credited.

If your report includes sensitive details, say so in your first email and we will arrange an encrypted channel. We can correspond in English or Hindi. Our contact details are also published in security.txt.

What to expect

• We will acknowledge your report within three business days.
• We will confirm whether we can reproduce the issue, and keep you informed while we fix it.
• We will tell you when it has been resolved, and agree any public disclosure with you.

Guidelines

When researching, please:

• test only against accounts you own or have permission to use;
• stop as soon as you have confirmed a vulnerability, and do not access, change or delete data that is not yours. If you come across personal data, stop and tell us;
• avoid anything that degrades our services, including denial-of-service or high-volume automated testing;
• not use social engineering, phishing or physical attacks against our staff or premises;
• give us reasonable time to fix the issue before you disclose it, and coordinate the timing with us.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised. We will not take or support legal action against you for it. If a third party takes action against you for activity carried out in line with this policy, we will make it known that your actions were authorised by us.

Out of scope

The following are not usually treated as vulnerabilities unless you can demonstrate real impact:

• missing security headers or cookie flags with no demonstrated exploit;
• clickjacking on pages without sensitive actions;
• SPF, DKIM or DMARC configuration reports;
• missing rate limits on non-sensitive endpoints;
• self-XSS, or issues that require a compromised device or browser;
• version disclosure or verbose errors that reveal nothing sensitive;
• unvalidated output from automated scanners;
• denial of service.

Recognition

We do not run a paid bug bounty programme. With your permission, we are glad to credit you publicly once the issue is resolved.