Scalric takes the security of our systems and our clients' data seriously. We welcome reports from security researchers and members of the public who identify vulnerabilities in our websites and services. This policy explains how to report responsibly and what you can expect from us.
In scope:
- scalric.com and its subdomains [list: e.g., app.scalric.com, api.scalric.com]
- Web applications, APIs, and mobile apps that Scalric owns and operates
Out of scope:
- Client-owned systems, or third-party services and platforms (including cloud, telephony, and AI providers). Report those to the relevant vendor.
- Social engineering, phishing, or physical attacks against staff, clients, or offices
- Denial-of-service (DoS/DDoS) or volumetric testing; spam
- Automated scanning that generates excessive traffic
- Findings from outdated browsers or platforms, or requiring unlikely user interaction
- Missing security headers, SPF/DKIM/DMARC configuration, or cookie flags without a demonstrated security impact
- Software version disclosure, clickjacking on pages with no sensitive actions, self-XSS, rate-limiting or brute-force observations without impact, and reports from automated tools with no proof of exploitability
To qualify for protection under this policy, you must:
- Act in good faith and avoid privacy violations, data destruction, and service disruption.
- Access only the minimum data necessary to demonstrate the issue. Do not view, copy, modify, retain, or exfiltrate personal data or client data. If you encounter it, stop and report.
- Not exploit a vulnerability beyond proof of concept, pivot to other systems, install persistent access, or alter data.
- Not disclose the vulnerability publicly or to third parties until we have confirmed remediation or 90 days have passed since your report, whichever is earlier (coordinated disclosure). We will work with you on timing.
- Comply with applicable law, and test only with your own accounts or accounts you have permission to use.
- Not demand payment as a condition of disclosure.
If you make a good-faith effort to comply with this policy, we will consider your research authorised and will not initiate or support legal action against you for it, including claims under computer misuse laws, the Information Technology Act, 2000 (India), or equivalent, or for circumventing technical controls strictly in the course of the research. This does not authorise testing out-of-scope assets and does not bind third parties; if legal action is brought by a third party, we will make it known that your actions were conducted in compliance with this policy. We reserve the right to act where research is conducted in bad faith or causes harm.
Email security@scalric.com (subject: "Vulnerability Report") with:
- A clear description of the vulnerability and affected asset(s)
- Step-by-step reproduction instructions or proof of concept
- Potential impact, in your assessment
- Your contact details, and any name or handle you would like credited (optional)
For sensitive details, ask for our PGP key [add key fingerprint and link] before sending. Please do not include real personal data in your report.
| Stage | Our target |
|---|---|
| Acknowledgement of your report | Within 3 business days |
| Initial triage and severity assessment | Within 10 business days |
| Status updates | At least every [14] days until resolution |
| Remediation | Critical: [7] days · High: [30] days · Medium/Low: [90] days (targets, not guarantees) |
| Confirmation of fix | We will notify you when resolved and, where appropriate, invite verification |
We will treat your report as confidential, investigate in good faith, and keep you informed.
We do not currently operate a paid bug-bounty programme [or: describe any reward]. With your permission, we will credit validated reports in a Security Acknowledgements list [add page]. Rewards, if any, are discretionary and are not guaranteed.
We recognise the first valid report of a given issue. Duplicates, and reports that are out of scope, theoretical, or lacking proof of impact, may be closed without further response.
We may update this policy from time to time. The version on this page applies at the time of your report.
Contact: security@scalric.com