Responsible Disclosure Policy

Last updated: July 2026

We take the security of Vachix seriously. If you believe you have found a vulnerability in our systems, we want to hear from you. This page explains what we consider in scope, how to report, what we commit to in return, and the protections we extend to good-faith researchers.

1. How to Report

Email support@vachix.in with a clear description of the issue. Include:

• The affected URL, endpoint, or component
• Steps to reproduce — a minimal proof-of-concept is ideal
• The potential impact as you see it
• Your contact details if you want us to credit you

We prefer English or Hindi. Encrypted submissions are welcome — PGP key available on request.

2. Our Commitments

• Acknowledgement within 72 hours — we will confirm receipt and assign the report an internal tracking ID.
• Remediation timeline within 14 days — we will share our assessment and an estimated fix date. Complex issues may take longer; we will keep you updated.
• No legal action — see Safe Harbour below.
• Credit — we will acknowledge your contribution publicly (with your permission) once the issue is resolved.

3. Scope

The following are in scope:

• Web application — *.vachix.com, *.vachix.in, *.vachix.co.in
• API — all endpoints under /api/* on those domains, including WebSocket endpoints
• Mobile app — the Vachix Android and iOS apps (when available)
• Authentication — login, registration, token handling, session management

4. Out of Scope

The following are not in scope. Reports about these will be closed without action:

• Third-party infrastructure we do not control: Supabase, Razorpay, Cloudflare, Groq, Google, Sarvam AI, Firebase
• Social engineering attacks against Vachix staff or users
• Physical attacks against our infrastructure
• Denial-of-service attacks (volumetric DDoS, resource exhaustion) — report these if you find an amplification vector, but do not actively test them
• Missing security headers or TLS configuration issues rated below Medium severity by industry standards (e.g. CVSS < 4.0)
• Clickjacking on pages with no sensitive actions or authenticated state
• Theoretical vulnerabilities with no demonstrated exploitability
• Automated scanner output submitted without manual triage or proof-of-concept
• Findings from accounts you do not own or have permission to test

5. What Counts as a Valid Report

We are particularly interested in:

• Authentication and authorisation bypass
• Injection vulnerabilities (SQL, command, template)
• Insecure direct object reference (IDOR) across user data
• Sensitive data exposure — tokens, PII, session data
• Cross-site scripting (XSS) with demonstrated impact
• Business logic flaws — for example, bypassing plan gates or credit limits
• WebSocket security issues — authentication bypass, message injection

A valid report includes a clear reproduction path that confirms the vulnerability exists. Scanner output, missing optional headers, and theoretical risks without a working example are not actionable.

6. Safe Harbour

Vachix will not pursue civil or criminal action against researchers who:

• Report in good faith following this policy
• Avoid accessing, modifying, or deleting data that is not their own
• Do not disclose the vulnerability publicly before we have had a reasonable opportunity to fix it (we request 90 days from acknowledgement)
• Do not perform destructive testing or denial-of-service attacks

If you act within these boundaries, we consider your research authorised under this policy and will work with you in good faith. We cannot extend this commitment to third-party services listed in Section 4 — those terms are controlled by their respective providers.

7. Coordinated Disclosure

We follow a 90-day coordinated disclosure timeline. If we cannot ship a fix within 90 days of acknowledgement, we will discuss an extension with you. We ask that you do not publish details of the vulnerability until either (a) the fix is live, or (b) the 90-day window has passed and we have agreed on a disclosure date together.

8. Contact

Security reports and general support: support@vachix.in

9. Security Testing

Alongside this responsible disclosure programme, Vachix runs internal security reviews of the systems in Section 3 as part of its development process, covering the OWASP Top 10 and business-logic risks such as session abuse, entitlement bypass, and payment replay. We have not yet commissioned a formal third-party penetration test. When we do, and where a formal VAPT certificate is needed, we intend to engage a CERT-In empanelled auditor.