Vulnerability Disclosure Policy

Dotnitron Technologies Private Limited takes the security and integrity of our systems, infrastructure, and client workflows seriously. We value the contributions of the security research community and welcome responsible, coordinated reports of potential security vulnerabilities.

This Vulnerability Disclosure Policy provides clear guidelines for security researchers conducting good-faith testing of our public services, explains how to report findings, and outlines what you can expect from us in return.

We consider security research conducted in strict accordance with this policy to be authorized, good-faith security research. If you make a good-faith effort to comply with this policy during your security research, Dotnitron will not initiate legal action against you or seek law enforcement intervention for accidental or good-faith violations.

To remain within the Safe Harbor, you must comply with all research rules in Section 4, avoid privacy violations and data destruction, and give us a reasonable opportunity to remediate vulnerabilities before sharing technical details publicly.

The following internet-facing properties and domains are strictly in scope for this policy:

• dotnitron.com (and all official subdomains such as www.dotnitron.com)

• Public-facing web application endpoints, API routes, and customer-facing demonstration environments operated directly by Dotnitron.

Out of scope: Any third-party service provider infrastructure (such as Vercel, PostHog, Formspree, AWS, or Google) is out of scope, except where a vulnerability is directly caused by Dotnitron's own configuration or application logic.

When conducting security research on our systems, you must adhere to the following rules:

• Data Protection & Privacy: Do not access, modify, download, retain, or exfiltrate customer, partner, employee, or confidential proprietary data. If you encounter sensitive data during testing, stop testing immediately, notify us, and do not share or publish the material.

• Availability & Non-Disruption: Do not execute Denial of Service (DoS/DDoS) attacks, resource-exhaustion tests, or high-volume automated scanner bursts that degrade system performance for legitimate visitors.

• No Social Engineering or Physical Attacks: Do not attempt phishing, spear-phishing, vishing, social engineering, or physical intrusion against Dotnitron personnel, contractors, offices, or facilities.

• Coordinated Disclosure: Keep vulnerability details confidential until Dotnitron has had a reasonable opportunity to investigate and deploy a fix. Do not disclose vulnerabilities to third parties or publish exploits without mutual agreement.

Please email your vulnerability report to info@dotnitron.com with the subject line '[Security Vulnerability Report]'.

To help us triage and resolve the issue quickly, please include:

• A detailed description of the vulnerability and its potential impact.

• Exact steps to reproduce the issue, including affected URLs, request parameters, and HTTP requests/responses.

• A proof-of-concept (PoC) demonstrating the flaw without altering or exfiltrating data.

• Any relevant screenshots, logs, or conceptual code.

• Your name, handle, or organization if you would like public recognition upon remediation.

Dotnitron commits to handling all vulnerability reports promptly and transparently in accordance with our Threat and Vulnerability Management Policy:

• Acknowledgment: We aim to acknowledge receipt of your report within 2 business days.

• Validation: We will provide an initial assessment and validity determination within 5 business days.

• Regular Updates: We will keep you informed of our remediation progress at key milestones.

Remediation timelines by severity (CVSS):

• Critical severity: 7 calendar days (24 to 72 hours if actively exploited or exposed on the internet).

• High severity: 30 calendar days.

• Medium severity: 90 calendar days.

• Low severity: 180 calendar days, or formally accepted with compensating controls.

Dotnitron does not operate a paid monetary bug bounty program at this time. However, we believe in giving credit where it is due: we publicly recognize researchers who responsibly discover and report valid security vulnerabilities in our Security Hall of Fame, subject to your consent.

Security metadata and machine-readable contact definitions are maintained in accordance with RFC 9116 at /.well-known/security.txt.