Vulnerability Disclosure Program
We value the security community and welcome responsible disclosure of vulnerabilities to help us protect our users and systems.
This is a recognition-only program. We do not offer monetary rewards, but we honor valid submissions with a Hall of Fame listing and a Letter of Recognition.
Our Commitment
At NotSecure, we take security seriously. We believe that working with the security research community is essential to maintaining a robust security posture. This page outlines how to report vulnerabilities responsibly and what you can expect from us.
Scope
In Scope
- Websites: *.notsecure.in (all subdomains)
- Framework: APTE Engine (including its API and related components)
- APIs: dashboard.notsecure.in and other official endpoints
Out of Scope
- Denial of Service (DoS) attacks
- Social engineering or phishing
- Physical security testing
- Third-party services not owned by NotSecure
- Non-security bugs or typos
How to Report
If you discover a vulnerability within our scope, please send a detailed report to:
What to Include
- Description of the vulnerability
- Steps to reproduce (with proof-of-concept if possible)
- Affected asset/URL or component
- Potential impact and severity assessment
- Your contact information (optional, but recommended)
Response Process
- Acknowledgment: We will confirm receipt within 48 hours.
- Investigation: Our team will validate the report (usually within 7 days).
- Resolution: We will work to fix confirmed issues in a timely manner.
- Communication: We will keep you updated on progress.
Recognition
As a token of our appreciation for helping us improve security, we offer the following non‑monetary recognition for valid reports:
Hall of Fame
Your name (or alias) will be permanently listed on our Hall of Fame page.
Letter of Recognition
We will provide an official letter acknowledging your contribution, which you can use for your portfolio or employer.
We do not offer monetary rewards, bounties, or gifts for vulnerability reports.
Safe Harbor
We will not pursue legal action against individuals who:
- Report vulnerabilities in good faith and follow this policy.
- Avoid accessing or modifying data beyond what is necessary to demonstrate the vulnerability.
- Do not publicly disclose the vulnerability before we have had a reasonable time to address it.
We appreciate your help in keeping our systems secure.
Need Help?
For any questions about this program, contact us at support@notsecure.in