Responsible Disclosure Policy
Guidelines for reporting security vulnerabilities in the Debryx platform.
Last updated:
Our Commitment
At Debryx, we take the security of our platform seriously. We welcome feedback from security researchers and the broader community. If you believe you have found a security vulnerability, we encourage you to report it to us responsibly.
Disclosure Process
Discover
Find a security vulnerability in the Debryx platform.
Report
Email details to security@debryx.in with subject "[Security Report]"
Acknowledge
We acknowledge receipt within 24 hours and begin investigation.
Remediate
We develop and deploy a fix. We keep you informed of progress.
Acknowledge
With your permission, we add you to our Security Acknowledgements.
Scope
This policy applies to:
- Debryx web application and associated APIs
- Debryx mobile applications (if applicable)
- Debryx open-source libraries and SDKs
This policy does not apply to:
- Third-party services integrated with the platform
- Debryx employees or contractors
- Physical security or social engineering attacks
How to Report
Please send a detailed report to security@debryx.in with the subject line [Security Report]. Include the following information:
- Type of vulnerability
- Steps to reproduce the issue
- Affected URL(s), endpoint(s), or component(s)
- Proof of concept (if applicable)
- Your contact information (optional)
Important: Do not publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and address the issue.
What to Expect
- Acknowledgment: We will acknowledge receipt of your report within 24 hours
- Investigation: We will investigate and provide an initial assessment within 5 business days
- Remediation: We will work to develop and deploy a fix within a timeframe proportional to the severity
- Disclosure: We will coordinate public disclosure timing with you
Safe Harbour
We consider activities conducted in accordance with this policy as authorised access and will not pursue legal action against you. We will not share your personal data with law enforcement unless required by law or with your consent.
Recognition
We maintain a Security Acknowledgements page recognising individuals who report valid security issues. If you would like to be acknowledged, please let us know in your report.
Out of Scope
The following issues are considered out of scope:
- Self-XSS or clickjacking without demonstrated impact
- Missing security headers without exploitable vector
- Rate limiting bypass on non-authentication endpoints
- Version disclosure or banner grabbing
- Social engineering or phishing attacks