HackSec Infotech
+91 90000 00000 Start a project

Security

Responsible disclosure policy

We are a security company. If you have found a flaw in our systems, we want to hear about it — and we will treat you well for telling us.

Last updated: 1 September 2026

Our commitment

We take security reports seriously and respond to every one. If you report an issue in good faith under this policy, we will not pursue legal action against you, we will keep you informed, and we will credit you publicly if you would like us to.

How to report

Email hacksecinfotech.ai@gmail.com with the subject line SECURITY. Please include:

  • The affected system, URL or endpoint
  • Clear reproduction steps, and a proof of concept if you have one
  • Your assessment of the impact
  • How you would like to be credited, if at all

Our machine-readable contact details are published at /.well-known/security.txt.

Our response times

  • Acknowledgement: within 2 business days
  • Initial triage and severity assessment: within 5 business days
  • Remediation target: 30 days for critical and high severity, 90 days for medium and low
  • Disclosure: coordinated with you once a fix is deployed

In scope

hacksecinfotech.com and its subdomains, and any infrastructure we operate directly.

Out of scope

  • Client systems. If you have found something in a system we built for a client, report it to us and we will coordinate with them — do not test it further.
  • Denial of service, volumetric or resource-exhaustion testing
  • Social engineering of our staff, customers or suppliers, and physical attacks
  • Reports generated solely by automated scanners with no demonstrated impact
  • Missing best-practice headers or configuration with no exploitable consequence
  • Vulnerabilities requiring a rooted or compromised device, or an outdated browser

Ground rules

  • Only test against accounts and data you own.
  • Stop as soon as you have confirmed a vulnerability — do not pivot, escalate or exfiltrate.
  • If you encounter personal data, stop immediately and tell us in the report.
  • Give us reasonable time to remediate before any public disclosure.

Recognition

We do not currently run a paid bug bounty. We do offer public credit, a written reference for your portfolio, and — for findings of genuine severity — a token of thanks. Our own team has responsibly disclosed to more than forty organisations, so we know exactly how it feels to be on your side of this exchange.