Reporting Security Issues
VD Consultancy takes the security of our systems seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.
How to Report
To report a security issue, please email us at: security@vdconsultancy.in
Please include the following information in your report:
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it
What to Expect
After you have submitted a report, we will:
- Confirm receipt of your vulnerability report within 2 business days
- Provide an estimated timeline for addressing the vulnerability
- Notify you when the vulnerability is fixed
Responsible Disclosure Guidelines
We ask that you:
- Give us reasonable time to investigate and mitigate an issue before public disclosure
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services
- Do not exploit a security issue beyond what is necessary to demonstrate the vulnerability
- Do not access or modify data that does not belong to you
Out of Scope
The following are typically considered out of scope:
- Distributed Denial of Service (DDoS) attacks
- Social engineering attacks
- Physical attacks against VD Consultancy property or employees
- Issues in third-party applications or services
Legal
We will not pursue legal action against researchers who:
- Follow these responsible disclosure guidelines
- Act in good faith
- Do not violate the privacy of our users or cause harm to our systems