Responsible Disclosure
Found a vulnerability? We want to hear from you. We take every good-faith report seriously.
1. Introduction
At Indic Shield Technologies, security is not just what we sell — it is how we operate. We believe that responsible security researchers play a vital role in keeping the internet safer, and we welcome good-faith reports of vulnerabilities in our systems.
If you have discovered what you believe to be a security vulnerability in our website or web-facing services, please follow this responsible disclosure process. We commit to working with you to understand and address the issue promptly.
2. Scope
This responsible disclosure policy covers:
- indicshield.ai — our main website and all subdomains we operate
- Any web-facing services or APIs directly operated by Indic Shield Technologies
Out of scope: Please see Section 5 for a full list of what we cannot investigate or act on through this programme.
3. How to Report
Send your report by email to our security contact:
Please include as much detail as possible:
- A clear description of the vulnerability
- Step-by-step instructions to reproduce it
- Your assessment of the potential impact
- Your contact details (name and email) so we can follow up
- Any screenshots, screen recordings or proof-of-concept code that help demonstrate the issue
PGP encryption: If you wish to encrypt your report, please request our PGP public key by emailing the address above first. We will share it promptly.
We will acknowledge receipt of your report within 2 business days. We aim to provide an initial assessment within 7 business days and to keep you informed of our progress throughout.
4. What We Commit To
Acknowledge Promptly
We will confirm receipt of your report within 2 business days and keep you informed of our investigation.
Investigate Thoroughly
We will assess and reproduce the issue, and work to understand its full scope and impact before responding.
Remediate in Good Faith
We will work to fix confirmed vulnerabilities in a reasonable timeframe based on severity, and notify you when the fix is deployed.
No Legal Action
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, following this policy.
Credit If Desired
With your permission, we will publicly credit you in our Hall of Fame on this page once the vulnerability is fixed.
Protect Your Privacy
We will keep your personal details confidential and will not share them without your permission, except as required by law.
What we ask from you: Please give us reasonable time to investigate and fix the issue before publishing or disclosing it publicly. We suggest a 90-day coordinated disclosure window from the date of your report. Contact us to discuss if you need a different timeline.
5. Out of Scope
The following activities and categories are outside the scope of this policy. Reports in these areas will not be acted on under this programme:
- Denial of Service (DoS/DDoS): Any testing that could affect availability for other users
- Social engineering: Phishing, vishing or impersonation attacks targeting our staff or users
- Physical attacks: Physical access to our offices, hardware or infrastructure
- Client systems: Systems or data belonging to our clients — we have no authority to grant testing rights on their behalf
- Third-party services: Services we use but do not control (e.g. Google Fonts CDN, email platforms, hosting provider infrastructure)
- Automated scanning without permission: Running vulnerability scanners or fuzzers against our production systems without prior written consent
- Reports with no demonstrable impact: E.g. missing security headers without a proof-of-concept exploit, or theoretical vulnerabilities with no evidence of exploitability
- Rate limiting or brute-force resistance: These are operational matters, not research findings
6. Bug Bounty Status
We currently do not offer monetary compensation as part of this programme. Indic Shield Technologies is an early-stage sole proprietorship and a paid bounty programme is not yet in place.
What we do offer: a sincere thank you, public acknowledgement in our Hall of Fame (with your consent), and the knowledge that you've helped make the broader ecosystem safer. We are a cybersecurity firm — your contribution genuinely matters to us.
We will revisit monetary rewards as the business grows. Researchers who have made valid reports will be considered first when any bounty programme launches.
7. Hall of Fame
We will publicly credit researchers who have responsibly disclosed valid vulnerabilities and given their consent to be listed. Credits are posted after a fix is deployed.
8. Contact
For all security reports and related questions:
Security email: security@indicshield.ai
General contact: hello@indicshield.ai
Phone: +91 78297 64838
For CERT-In mandated incident reporting, we comply with the 6-hour reporting window under CERT-In Directions, 2022. If you believe you have found evidence of a security incident (not just a vulnerability), please include that in your report and we will escalate accordingly.