Try DPDP Shield →

SECURITY & TRUST

Vulnerability Disclosure Policy

Kryptasys is committed to ensuring the security of our platform and infrastructure. We value the security research community's assistance in identifying vulnerabilities responsibly.

1. Our Commitment

Kryptasys takes the security of our products and services seriously. We welcome reports from security researchers, security professionals, and ethical hackers who discover vulnerabilities in our systems. We commit to working with you to validate, understand, and address reported issues promptly.

2. Scope

This policy applies to digital assets owned and operated directly by Kryptasys.

In Scope
  • DPDP Shield: shield.kryptasys.in
  • Kryptasys Main Site: kryptasys.in
  • LEAP Forensic Engine: leap.kryptasys.in
  • API Endpoints: All Kryptasys cloud worker endpoints
Out of Scope
  • Third-party services (Supabase, Vercel, Cloudflare, payment processors)
  • Social engineering, phishing, or spear-phishing attacks
  • Physical security or office facility attacks
  • Denial of Service (DoS/DDoS) attacks

3. How to Report

Please send your security reports directly to our security response team:

Email: contact.kryptasys@proton.me
Subject line format: [SECURITY] Vulnerability Summary — Target Asset

To assist us in triaging your report, please include:

  • • Detailed description of the vulnerability and potential security impact
  • • Step-by-step instructions or proof-of-concept (PoC) script to reproduce the issue
  • • Target URL, API endpoint, or component affected
  • • Your contact details and public handle for attribution (optional)

4. Response Timeline

We prioritize security vulnerabilities based on severity and operational impact:

1

Acknowledgement

Within 48 hours of receipt

2

Initial Assessment

Triaged within 5 business days

3

Patch Release

Remediation within 30 days

4

Disclosure

Coordinated public write-up

5. Safe Harbor Guidelines

Kryptasys will not pursue legal action against security researchers who adhere to the following principles:

  • • Conduct research in good faith and avoid privacy violations, data destruction, or disruption of service.
  • • Do not access, modify, or exfiltrate Data Principal records or personal identifiers.
  • • Provide reasonable time for Kryptasys to remediate the vulnerability before public disclosure.
  • • Comply with applicable local cyber regulations, CERT-In guidelines, and DPDPA 2023 principles.

Good-faith security research conducted under this policy is considered authorized conduct.

6. Security Hall of Fame

We acknowledge researchers who help protect Kryptasys users through responsible disclosure.

Be the first security researcher recognized in the Kryptasys Security Hall of Fame.

Submit a Security Report

Have you discovered a potential vulnerability? Connect with our response team.

Report a Vulnerability