Purpose

DeshiApp is committed to maintaining the highest standards of cybersecurity, data privacy, and systems resilience across its digital publishing platform. As an independent media organization reporting on India’s technology ecosystem, consumer applications, and sovereign Digital Public Infrastructure, we recognize that independent security researchers, ethical hackers, and technical analysts play an indispensable role in securing the internet. We welcome good-faith, responsible vulnerability disclosures that help safeguard our readers, journalists, confidential sources, contributors, corporate partners, and web infrastructure.

This policy establishes a coordinated, safe, and structured framework for discovering, validating, reporting, and remediating security vulnerabilities affecting digital assets owned and operated by DeshiApp. Its objectives are to provide a reliable security contact point, define authorized good-faith research activities, prevent system disruption, safeguard personal data and source confidentiality, establish realistic remediation windows, outline our safe-harbor legal protections, and clearly distinguish ethical vulnerability disclosure from malicious cyber attacks.

Security Contact

Security vulnerability disclosures, cryptographic reports, and responsible research notices must be transmitted directly to security@deshiapp.in. In accordance with RFC 9116, DeshiApp also maintains a machine-readable security.txt file hosted at the canonical location https://deshiapp.in/.well-known/security.txt. This file identifies our official security contact, links to this policy, indicates English as our preferred reporting language, and provides a validated expiry date. The security.txt file is updated regularly before its expiration timestamp. Where cryptographic public keys are supported, our PGP encryption key fingerprint is published in the security.txt file, allowing researchers to encrypt sensitive proof-of-concept reports.

Urgent Reports

Vulnerability reports must be flagged with ‘URGENT’ in the subject line if they involve active, in-the-wild exploitation, exposed administrative database credentials, leaked private cryptographic keys, unauthorized full-access remote code execution (RCE), ongoing exfiltration of personal reader data, unencrypted leaks of confidential journalistic sources, live ransomware activity, mass malware distribution via our edge CDN, active phishing campaigns hosted on our domains, or complete website defacement. The urgent designation must be reserved for critical emergencies rather than low-severity issues.

Scope

This policy applies strictly and exclusively to digital assets, web servers, domains, and application interfaces owned and directly operated by DeshiApp. In-scope targets include the primary publication domain deshiapp.in, first-party web forms, the core content management system (CMS) hosted on DeshiApp servers, first-party subdomains, public-facing REST application programming interfaces (APIs) operated by DeshiApp, and our dedicated security contact infrastructure.

DeshiApp maintains an active, auditable digital asset inventory and will update the public scope definitions whenever material infrastructure modifications occur.

Third-Party Services

DeshiApp utilizes specialized third-party cloud infrastructure providers for edge content delivery, global DNS routing, email delivery, transactional accounting, consent management, cloud firewalls, and server virtualization. Security vulnerabilities residing within third-party infrastructure fall under the respective vendor’s independent vulnerability disclosure program. Researchers are strictly prohibited from conducting security testing against third-party providers simply because they provide services to DeshiApp.

Where a vulnerability report impacts a third-party vendor, DeshiApp will coordinate responsibly with the provider, implement configuration workarounds where possible, or suspend the integration pending remediation. This policy cannot grant authorization to test systems DeshiApp does not control.

Good-Faith Research

Security research is recognized as conducted in good faith when the researcher acts solely to identify and remediate vulnerabilities, strictly avoids causing harm or service degradation, confines testing entirely to in-scope assets, adheres to this policy, utilizes the least intrusive testing methods available, halts testing immediately upon confirming a vulnerability, avoids accessing personal data or source records, reports findings promptly, preserves strict confidentiality, allows reasonable remediation time, demands no financial extortion, and cooperates constructively with our security team.

Good faith is judged based on the total demonstrable conduct of the researcher, rather than subjective intentions or uncorroborated assertions.

Authorized Research

Subject to applicable law and the strict boundaries set forth herein, DeshiApp formally considers security testing authorized for the limited purpose of vulnerability discovery where the researcher complies with all policy guidelines, restricts testing to in-scope systems, avoids prohibited methodologies, accesses zero unnecessary data, refrains from altering or deleting data, avoids degrading service uptime, avoids social engineering, reports findings without delay, and respects coordinated disclosure schedules.

This limited authorization does not extend to third-party assets, nor does it condone any activity that violates Indian law outside the scope of authorized ethical research.

Safe-Harbor Approach

Where an independent security researcher makes an authentic, good-faith effort to comply with this policy, remains within defined scope, avoids causing operational harm, and coordinates responsibly with our team, DeshiApp treats the activity as authorized and commits not to initiate civil lawsuits or pursue criminal complaints under Section 43 or Section 66 of the Information Technology Act, 2000 against the researcher for their compliant research. Researchers uncertain about proposed testing should seek prior clarification via security@deshiapp.in.

This safe-harbor pledge cannot bind external third parties, override mandatory statutory obligations, authorize access to third-party networks, protect extortion or data theft, grant immunity for malicious actions, or restrict DeshiApp from deploying technical defenses to contain active threats.

Prohibited Testing

Under no circumstances does this policy authorize: distributed denial-of-service (DDoS) attacks, volume-based form flooding, destructive database alterations, defacing published articles, accessing or modifying another user’s account, attempting to unmask confidential journalistic sources, mass data exfiltration, scraping reader databases, harvesting credentials, deploying malware, establishing persistent backdoors, conducting phishing or social engineering attacks against staff, attempting physical security intrusions against offices, testing third-party services, modifying financial or advertising accounts, intercepting private staff communications, or utilizing aggressive, high-speed automated fuzzers that degrade server stability.

Stress testing, load testing, and denial-of-service simulations are strictly forbidden without advance, written authorization from DeshiApp’s technical leadership.

Personal Information

If a researcher inadvertently encounters personal data during testing, the researcher must immediately cease testing, avoid further inspection, refrain from downloading or copying the data, capture minimal redacted evidence, notify DeshiApp urgently via security@deshiapp.in, securely delete all local copies following confirmation, and never attempt to contact affected data subjects independently. Personal information must never be weaponized for extortion, public exposure, or harassment.

Confidential Sources and Editorial Material

DeshiApp maintains sensitive investigative records, unpublished journalistic drafts, and confidential source identities. Researchers must never attempt to access, exfiltrate, or inspect whistleblower communications, unreleased investigative dossiers, contributor contracts, legal memorandums, or internal newsroom chats. If source-related data is encountered accidentally, testing must stop immediately, an urgent report must be filed, and the sensitive data must not be replicated.

Credentials and Secrets

Researchers must not publish, trade, or weaponize discovered passwords, private cryptographic keys, API tokens, database connection strings, authentication cookies, or session identifiers beyond the absolute minimum necessary to demonstrate exposure safely. Proof-of-concept reports must redact all secrets. DeshiApp immediately revokes and rotates all exposed credentials upon notification.

Automated Scanning

Carefully configured, non-destructive automated security scanning is permissible solely where it targets in-scope systems, enforces strict rate limits (no more than 2 requests per second), avoids destructive payloads, avoids brute-force authentication, causes zero service degradation, and halts immediately upon detecting a potential issue. Researchers bear full responsibility for the behavior of their automated tools.

Credential Testing and Accounts

Credential stuffing attacks, password spraying, and dictionary brute-force attacks against administrative login portals are strictly prohibited. Researchers must demonstrate rate-limiting deficiencies using a single test account under their personal control, never utilizing credentials obtained from external data breaches.

Where testing requires an active user account, researchers must register their own test accounts, avoiding interactions with real readers, never modifying other users’ profiles, never publishing live articles, and avoiding deceptive multi-accounting.

Uploaded Files

Testing file upload endpoints must never involve active malware, webshells, automated worm scripts, illegal material, server-crashing zip bombs, or executable payloads designed to achieve persistent root execution. Harmless, benign proof-of-concept files (such as text files executing a simple non-destructive command) must be utilized.

Cross-Site Scripting and Injection

Cross-Site Scripting (XSS) vulnerabilities must be demonstrated using benign payloads (such as displaying an alert dialog using alert(document.domain)). Researchers must never execute session hijacking, steal authentication cookies, inject malicious redirects, or leave persistent XSS payloads active in public production databases.

SQL injection, remote code execution (RCE), and server-side template injection (SSTI) must be tested with minimal, non-destructive queries (e.g., retrieving database version strings). Researchers must never dump complete database tables, alter database schemas, execute system shell commands, or establish persistent backdoors.

Server-Side Request Forgery and File Access

Server-Side Request Forgery (SSRF) vulnerabilities must be demonstrated by interacting with a benign, researcher-controlled callback server. Researchers must never scan internal cloud metadata endpoints (e.g., 169.254.169.254), access internal subnets, or pivot through DeshiApp infrastructure to target third-party networks.

Path traversal or local file inclusion (LFI) vulnerabilities must be proven against benign system files (e.g., /etc/hosts). Researchers must never retrieve database configuration files, private cryptographic keys, source code repositories, or sensitive user files.

Authentication and Authorization

Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities must be verified using two test accounts controlled by the researcher, demonstrating that Account A can access Account B’s test data. Researchers must never access, view, or alter live data belonging to real readers or staff members.

Payment and Financial Systems

Testing payment gateways, corporate billing endpoints, or advertising transaction workflows requires advance written authorization. Researchers must never trigger fraudulent transactions, initiate unauthorized chargebacks, manipulate invoice amounts, access payment card numbers, or create financial liabilities.

Published Content Risks

Security reports may also highlight published risks, such as accidentally exposed credentials in published articles, malicious external links, compromised ad network tags, or unstripped confidential metadata in downloadable PDFs. Reports must pinpoint the exact URL and issue without disseminating malicious links.

Out-of-Scope Findings

The following findings are considered out of scope unless accompanied by demonstrable, severe real-world security impact: missing HTTP security headers (e.g., CSP, HSTS) without demonstrated exploitation, self-XSS requiring social engineering, clickjacking on static public pages, software version banner disclosures, SPF/DKIM/DMARC record best practices without demonstrable spoofing risk, rate-limiting theories without functional exploitation, unverified automated scanner reports, and general theoretical best-practice recommendations.

DeshiApp may review lower-risk findings at its discretion. Technical accessibility bugs belong at accessibility@deshiapp.in, and factual reporting corrections belong at corrections@deshiapp.in.

Report Contents

A high-quality vulnerability report must include: the researcher’s name or chosen handle, contact email, the affected domain or URL, vulnerability classification, discovery date, testing environment, clear step-by-step reproduction instructions, minimal proof-of-concept payload, observed vs. expected behavior, estimated technical impact, confirmation of whether personal data was accessed, and suggested remediation steps.

Supporting evidence should consist of redacted screenshots, HTTP request/response transcripts, and short screen recordings. Bulk database dumps, active exploits, and unredacted source documents must never be sent via standard email. Secure transmission channels will be provided upon request.

Encryption

Where DeshiApp maintains an active PGP public encryption key, researchers are encouraged to encrypt sensitive vulnerability submissions. The key fingerprint and download link are maintained in our canonical security.txt file.

Acknowledgement and Triage

DeshiApp strives to acknowledge all credible security vulnerability reports within five business days of receipt. Initial acknowledgement confirms tracking reference assignment and scope verification. Critical, high-severity vulnerabilities receive priority triage within 24 to 48 hours.

Vulnerability triage evaluates the affected component, ease of reproduction, exploitability, potential confidentiality/integrity/availability impact, source protection implications, and legal compliance obligations under Indian law.

Communication and Remediation

DeshiApp maintains active communication with the reporting researcher throughout the remediation lifecycle, providing status updates on validation, vendor dependencies, patch development, and deployment milestones.

Remediation measures include code refactoring, firewall rule deployment, credential rotation, software updates, access restrictions, or vendor patch integration. Temporary mitigations may be deployed while complex architectural fixes are engineered.

Retesting of remediated endpoints is subject to the same scope and non-destructive testing requirements. Prior reporting authorization does not grant ongoing permission to test other systems.

Coordinated Disclosure

DeshiApp operates under the principles of Coordinated Vulnerability Disclosure (CVD). We request that researchers allow a reasonable remediation window (typically 60 to 90 days from initial report validation, depending on technical complexity) before publishing any public research or advisory. DeshiApp does not demand indefinite secrecy to conceal embarrassment.

Where remediation requires extended engineering or vendor coordination, DeshiApp and the researcher may agree to mutually synchronized disclosure timelines or redacted interim advisories. Researchers must never publish active zero-day exploit code, unredacted credentials, or personal data.

Recognition and No Bounty Promise

DeshiApp operates a public Security Hall of Fame acknowledging researchers who submit verified, impactful vulnerability reports in good faith. With the researcher’s consent, public credit will include their name or handle, organization, and a link to their professional profile.

DeshiApp does not currently offer a paid bug bounty program. Submitting a report does not establish an entitlement to monetary remuneration, consulting contracts, employment, or reimbursement. Researchers must never demand financial payment or threaten public disclosure in exchange for vulnerability details.

Incidents and Personal-Data Breaches

If a vulnerability report exposes an active data breach or ongoing unauthorized systems intrusion, DeshiApp will immediately activate its formal Incident Response Protocol: containing the breach, preserving forensic evidence, rotating credentials, initiating technical remediation, and assessing regulatory notification obligations.

Where personal information is compromised, DeshiApp will notify competent authorities (including CERT-In and the Data Protection Board of India) and communicate with affected individuals in strict compliance with statutory mandates. Researchers must not contact affected users directly.

Confidentiality and Retention

Access to vulnerability submissions is strictly restricted to authorized security personnel, systems engineers, and legal counsel on a need-to-know basis. Details may be shared with external hosting providers or law enforcement where necessary to resolve the incident.

Security disclosure records, technical reports, and remediation logs are retained securely for tracking and compliance purposes, following which unnecessary personal data is securely deleted.

No Retaliation and Policy Violations

DeshiApp firmly commits not to retaliate against any researcher who conducts good-faith security research and reports vulnerabilities in accordance with this policy. This protection does not apply to extortion, intentional data theft, deliberate disruption, public zero-day drops, or testing outside declared scope.

If a researcher unintentionally exceeds policy boundaries while testing, the researcher should immediately cease testing, notify security@deshiapp.in, preserve evidence safely, and cooperate constructively in mitigating potential harm. Good-faith transparency will be considered favorably.

Security.txt

Our canonical machine-readable security configuration is publicly available at https://deshiapp.in/.well-known/security.txt, designating security@deshiapp.in as our official contact, identifying English as our language, linking to this policy, and specifying a valid expiry date.

Contact

Security vulnerability disclosures should be sent to security@deshiapp.in. For data privacy inquiries, contact privacy@deshiapp.in. For accessibility issues, contact accessibility@deshiapp.in. For factual corrections, contact corrections@deshiapp.in. For formal legal notices, contact legal@deshiapp.in.