Security Disclosure

Our Coordinated Vulnerability Disclosure (CVD) program, Safe Harbor legal protections for ethical security researchers, reporting criteria, and response SLA.

ALL POLICIES LEGAL INQUIRIES

TABLE OF CONTENTS

HAVE QUESTIONS?

If you require specific interpretations of this policy, please reach out.

Contact Support

SECTION 01

1. Coordinated Vulnerability Disclosure (CVD)

Spyber Polymath is committed to maintaining the highest security posture across our platforms, open-source repositories, and client environments. This Vulnerability Disclosure Policy establishes clear guidelines for security researchers ("Researchers", "You") to conduct ethical testing and report discovered vulnerabilities.

•

Mutual Cooperation:We pledge to work openly and collaboratively with security researchers who report potential flaws in our infrastructure in good faith.

•

No Legal Jeopardy:We will not initiate legal action against researchers who adhere strictly to the terms of this Safe Harbor policy.

SECTION 02

2. Safe Harbor Protections

If you conduct research in full compliance with this policy, Spyber Polymath considers your activities to be authorized under applicable anti-hacking laws (including the Indian Information Technology Act, 2000, Section 43 & 66):

•

Authorization:We consider your research authorized and will not pursue civil claims or recommend criminal complaints against you for good-faith testing.

•

Third-Party Claims:If legal action is initiated by a third party against you for testing that occurred within our designated scope, we will make our authorization known.

•

Good Faith Criterion:You must halt testing and notify us immediately if you encounter sensitive personal data, financial details, or internal corporate records.

SECTION 03

3. Scope of Systems

Authorized targets for vulnerability research include:

•

In-Scope Domains:spyberpolymath.com, spyberpolymath.in, and their direct public web applications and API endpoints.

•

In-Scope Repositories:Public open-source source code repositories maintained directly under the official github.com/spyberpolymath organization.

•

Strictly Out-of-Scope:Third-party services (Vercel, Cloudflare, GitHub, AWS, Stripe), physical office hardware, non-public staging servers belonging to private commercial clients, and any affiliate domains without explicit written consent.

SECTION 04

4. Prohibited Testing Techniques

The following activities are strictly prohibited and will void Safe Harbor protections immediately:

•

Denial of Service:Volumetric network attacks, application-layer exhaustion, HTTP/2 Rapid Reset exploits, or any activity that degrades availability for legitimate users.

•

Social Engineering & Phishing:Spear-phishing, credential harvesting, impersonation, or physical intrusion directed against our founder, contractors, or partners.

•

Data Modification or Exfiltration:Accessing, altering, destroying, or exfiltrating data beyond the minimum necessary proof-of-concept (POC) to demonstrate the vulnerability.

•

Spamming & Automated Scans:Automated vulnerability scanners (e.g., Nessus, Acunetix, Burp Suite Active Scan) generating high request volumes against production endpoints.

SECTION 05

5. Submission Format & Details Required

To enable prompt triage and remediation, submit vulnerability disclosures to security@spyberpolymath.com with the subject line 'VULNERABILITY DISCLOSURE - [VULNERABILITY TYPE]':

•

Summary & Severity:A clear description of the vulnerability and its estimated impact (e.g., CVSS v3.1 score if known).

•

Reproduction Steps:Detailed, step-by-step reproduction instructions, HTTP request/response transcripts, cURL commands, or minimal non-destructive POC scripts.

•

Affected Endpoint:The full URL, parameter, API route, or code commit hash where the vulnerability resides.

•

Suggested Remediation:Specific technical mitigation or architectural recommendations, if known.

SECTION 06

6. Triage Timelines & Response SLA

We take security reports seriously and commit to the following operational turnaround benchmarks:

•

Initial Acknowledgment:Within twenty-four to forty-eight (24–48) hours of receipt.

•

Triage & Validation:Within five (5) business days to confirm reproduceability and impact severity.

•

Remediation & Patching:Target patch timeline of 7 to 30 calendar days depending on vulnerability criticality.

•

Coordinated Public Disclosure:We request a mutual non-disclosure embargo period of ninety (90) calendar days to deploy patches before public disclosure.

LOADING CONTENT...