Security & Responsible Disclosure

1. In scope

• www.zyvark.in and zyvark.in (this website and its form APIs)

2. Out of scope

• Denial-of-service or load testing, and anything that degrades the service for others
• Social engineering, phishing or physical attacks against anyone
• Spam or automated submissions through our forms
• Findings that need a compromised device or browser, or that only affect outdated browsers
• Reports from automated scanners without a demonstrated, exploitable impact
• Third-party services we use (please report those to the provider)

3. How to report

Please include:

• the affected URL or component, and what an attacker could achieve;
• step-by-step instructions to reproduce it;
• any proof-of-concept, kept to the minimum needed to show the issue.

Access only the data you need to demonstrate the problem, never other people's, and delete anything you obtained once you have reported it. Give us reasonable time to fix the issue before you disclose it publicly.

4. What we will do

• Aim to acknowledge your report within 5 business days.
• Keep you informed while we investigate and fix it.
• Credit you publicly once it is fixed, if you would like to be credited.

We do not currently run a paid bug-bounty programme. If you research and report in good faith and within this policy, we will not pursue legal action against you for that research.

5. Serious incidents

Cyber-security incidents affecting systems in India can also be reported to CERT-In, the national incident-response agency, at cert-in.org.in.

6. How this site is protected

• HTTPS only, with HSTS and a strict Content-Security-Policy
• No third-party trackers and no visitor cookies
• Same-origin checks, input validation, rate limiting and a honeypot on every form
• Owner-only administration with a hashed password, signed sessions and an audit log
• Dependencies audited and the whole site tested automatically on every change