Responsible Disclosure Policy

Email security@virabha.com. Please include enough detail for us to reproduce the issue: the affected URL or endpoint, the steps you took, what you expected, and what actually happened. A proof-of-concept request, screenshot, or short video helps considerably.

If a report contains sensitive material, say so in the first message and we will arrange an encrypted channel before you send details.

Please do not open a public issue, post publicly, or contact individual staff members about a suspected vulnerability.

• We acknowledge every report within 72 hours of receipt.
• We give you an initial assessment — whether we have reproduced the issue and how we have rated it — within 10 working days.
• We keep you updated as we work on a fix, and we tell you when it ships.
• We are happy to credit you publicly once the issue is resolved, if you would like that. Tell us the name you would like used.

We aim to resolve confirmed issues within 90 days. If we need longer, we will explain why. We ask that you give us that window before disclosing publicly, and we will work with you on timing rather than against you.

If you make a good-faith effort to comply with this policy during your research, we will treat that research as authorised. We will not pursue or support legal action against you, and if a third party brings action against you for activity conducted under this policy, we will make it known that your research was authorised.

If you are unsure whether something is in scope or whether a particular technique is acceptable, ask us first. We would much rather answer a question than receive an apology.

The Virabha web application, its public API, and its authenticated customer, vendor and administrative surfaces are in scope.

The following are out of scope:

• Denial-of-service, volumetric, or load-generating tests of any kind.
• Social engineering, phishing, or physical attacks against our staff, customers, or offices.
• Findings that only affect out-of-date browsers or unpatched client software.
• Reports generated solely by an automated scanner, with no demonstrated impact.
• Missing security headers, cookie flags, or TLS configuration details with no demonstrated exploit path.
• Vulnerabilities in third-party services we do not operate.

• Use only accounts you own or have explicit permission to test. Never access, modify, or retain another person's data.
• If you encounter personal data, customer records, or payment information, stop immediately, do not save a copy, and tell us in your report.
• Do not run tests that degrade, interrupt, or damage the service for anyone else.
• Do not attempt to move money, place orders, or alter holdings beyond the minimum needed to demonstrate an issue.
• Delete any data you obtained during testing once your report is resolved.

Virabha does not currently operate a paid bug-bounty programme. We offer public credit and our genuine thanks. This policy will be updated if that changes.

For a complaint that is not a security issue, please use our grievance redressal process. For how we handle personal data, see the Privacy Policy.