Reporting a vulnerability
Email security@infiorbit.in with the affected asset or endpoint, reproduction steps or a proof of concept, the impact you believe it has, and anything needed to reproduce it (accounts, tenant configuration). A machine-readable pointer to this policy is published at /.well-known/security.txt (RFC 9116).
We acknowledge reports within 3 business days and provide a triage decision with severity within 10 business days. Remediation timelines are communicated per severity and we keep you updated until resolution.
Scope
- In scope: this website, the tenant web application, the admin console, the public API, and our official SDKs and client applications.
- Out of scope: volumetric denial of service, social engineering or phishing of staff or tenants, physical attacks, findings in third-party services we do not operate, and mail-authentication configuration reports without a demonstrated exploit.
Safe harbor
Research conducted in good faith and within this policy is authorized. We will not pursue legal action for accidental, good-faith violations.
Never access, modify or exfiltrate data belonging to other tenants; if you encounter such data, stop immediately and include that in your report. We follow a 90-day coordinated disclosure window by default.
Recognition & bounty status
There is no paid bounty program yet; a managed program opens after our first external penetration-test remediation cycle. Until then we credit reporters in our security acknowledgements with their permission.