Last updated: 8 October 2026
Rudranetra is a security company, and we hold ourselves to the standards we test others against. If you believe you've found a security vulnerability in a Rudranetra system, we want to hear from you. This policy explains what you can test, how to report it, and what you can expect from us.
Scope
In scope
- rudranetra.com
- Any subdomain of rudranetra.com that we operate
Out of scope
- Systems, applications or data belonging to our clients. If you believe a vulnerability affects a Rudranetra client, report it to that organisation directly.
- Third-party services we use (for example hosting, email, form or analytics providers). Please report those to the relevant vendor.
- Denial-of-service or load testing, spam, social engineering or phishing of our staff, and physical attacks.
- Findings from automated scanners without a demonstrated, practical security impact.
- Missing best-practice headers or configurations without a demonstrated exploit, clickjacking on pages with no sensitive actions, self-XSS, and reports about software versions or banners alone.
How to report
Email security@rudranetra.com with:
- A description of the vulnerability and its potential impact
- The affected URL, component or parameter
- Step-by-step instructions to reproduce it, including any proof-of-concept
- Your name or handle, if you would like to be credited
Please don't include sensitive personal data in your report unless it's necessary to demonstrate the issue.
Rules for testing
When investigating a vulnerability, please:
- Only test systems listed in scope
- Use the minimum access needed to demonstrate the issue, and stop as soon as you've confirmed it
- Not access, change, delete or keep data that isn't yours. If you encounter personal or confidential data, stop, don't copy it, and tell us in your report
- Not degrade or disrupt our services, and avoid automated scanning at high request rates
- Not use social engineering, phishing or physical methods
- Keep the details confidential until we've resolved the issue or agreed a disclosure date with you
What you can expect from us
- Acknowledgement within 3 business days
- Initial assessment within 10 business days, including whether we can reproduce the issue
- Regular updates on progress until the issue is resolved
- Credit on this page once fixed, if you want it
- Coordinated disclosure: we aim to fix valid issues within 90 days and will agree any public disclosure timing with you
We don't currently run a paid bug bounty programme, so we can't offer financial rewards. We're grateful for every responsible report.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue legal action against you for it, and we will work with you to understand and resolve the issue quickly. If a third party takes legal action against you for activities that complied with this policy, we will make it known that your actions were conducted under this policy. If in doubt about whether something is allowed, ask us first at security@rudranetra.com.
How we disclose vulnerabilities we find
During our security research, we sometimes discover vulnerabilities in third-party software.
- Client engagements: findings belong to our clients and are reported only to them, under NDA. We never disclose client findings publicly.
- Independent research: when we find a vulnerability in publicly available software outside a client engagement, we report it privately to the vendor first and follow coordinated disclosure, normally allowing 90 days for a fix before publishing details. We may adjust this timeline if a fix is near, if the vulnerability is being actively exploited, or if the vendor is unresponsive.
- We request CVE identifiers where appropriate and credit the vendor's cooperation in any publication.
Hall of thanks
Credited researchers will be listed here.
Contact: security@rudranetra.com · security.txt