1. Purpose and Scope
This Security Disclosure Policy describes how to report a suspected security vulnerability affecting websites, online services, or systems owned and operated by S-Curity LLC (“S-Curity,” “we,” “us,” or “our”), an associated company of VDHOSTS INTERNET PRIVATE LIMITED. It is intended to encourage good-faith reporting and coordinated remediation. This policy is not a contract for security services and does not, by itself, grant permission to test any system.
2. Report a Vulnerability
Send a report to care@s-curity.com with the subject line “Responsible Security Disclosure”. Include, where safe and available:
- a clear description of the suspected issue and its potential impact;
- the affected URL, product, version, or system, without including unrelated third-party targets;
- the minimum steps needed to reproduce the issue, preferably in a test account or non-destructive proof of concept;
- timestamps and relevant request or response details with passwords, tokens, personal data, and other secrets redacted;
- your preferred contact method and any reasonable disclosure timeline you propose.
Please do not attach live credentials, private keys, exploit payloads intended to damage systems, or bulk personal data. If you accidentally encounter sensitive information, stop testing immediately, do not access or retain more than is necessary to demonstrate the issue, and tell us promptly.
3. Testing Rules and Prohibited Conduct
Do not perform testing without prior written authorisation from the system owner. This policy does not authorise penetration testing, scanning, exploitation, social engineering, denial-of-service testing, credential attacks, physical testing, or access to accounts or data. Do not:
- access, modify, exfiltrate, delete, or disclose data that does not belong to you;
- degrade, interrupt, or threaten service availability, including denial-of-service or resource-exhaustion tests;
- conduct phishing, social engineering, physical intrusion, or attacks against employees or customers;
- use persistence, install malware, establish backdoors, or pivot to other systems;
- test third-party infrastructure, vendors, customers, or systems outside S-Curity's control without their express authorisation;
- use automated testing that creates material load, bypass access controls, or violate applicable law; or
- publicly disclose a vulnerability or related data before coordinated discussion with us, except where disclosure is legally protected or required.
4. Our Handling of Reports
We will make reasonable efforts to acknowledge reports, assess the information supplied, communicate where practical, and remediate or otherwise address validated issues based on severity, feasibility, and risk. Response and remediation times are not guaranteed. We may request additional details or clarify the affected asset. We may close reports that are duplicates, out of scope, not reproducible, based solely on unsupported scanner output, or that do not identify a security impact.
5. Coordinated Disclosure
Please allow us a reasonable opportunity to investigate and address a reported issue before publishing technical details. We encourage reporters to agree on a disclosure date with us. Do not publish personal data, customer information, credentials, or details that would create an immediate risk to users. We may coordinate with affected vendors, customers, hosting providers, or relevant authorities where necessary. We cannot guarantee that we will approve a proposed disclosure date or provide public credit.
6. Safe-Harbour Limitations
We appreciate good-faith security research, but this policy does not create a blanket safe harbour, waive legal rights, or promise immunity from civil or criminal liability. We will consider the circumstances of a report and the researcher's adherence to this policy when responding, to the extent permitted by law. Only explicit written authorisation from an authorised system owner can establish permission for testing within a defined scope. If you are unsure whether an action is permitted, stop and ask before proceeding.
7. Rewards and Recognition
Unless we publish a separate written bug bounty programme or make a specific written offer, S-Curity does not promise monetary rewards, gifts, employment, public recognition, or other compensation for vulnerability reports. Do not assume that a report qualifies for a reward programme run by another company.
8. Personal Data and Confidentiality
We will handle information included in a report for triage, investigation, remediation, legal compliance, and protection of our systems. Please minimise personal data and redact secrets before submission. Do not submit information you are not authorised to disclose. We may share relevant details with employees, professional advisers, affected service providers, or authorities on a need-to-know basis and as permitted or required by law.
9. Out-of-Scope Reports
Reports concerning systems not owned or operated by S-Curity, purely theoretical concerns without a realistic security impact, unsupported software versions, social-engineering-only findings, physical security, or issues requiring prohibited testing may be out of scope. We may redirect a report to a responsible third party when appropriate, but we are not obliged to do so.
10. Contact
Submit reports to care@s-curity.com. Use the subject “Responsible Security Disclosure.” Do not send emergency incident details through a public contact form. If a suspected incident creates immediate risk to people or critical services, contact the relevant emergency or competent authority as appropriate.
Questions or legal notices: care@s-curity.com