Vulnerability Disclosure Policy

At DhamaniLink, security is a top priority. We recognize the important role that security researchers and our community play in keeping our platform and customers safe. If you believe you have discovered a vulnerability, we ask that you report it to us in a responsible manner.

Rules of Engagement

• Do not attempt to access or modify data that does not belong to you.
• Do not degrade the performance of our services (e.g., volumetric testing, DoS/DDoS).
• Do not use social engineering, phishing, or physical attacks against our employees or users.
• Do not run automated scanners that generate excessive traffic (limit requests to manual testing or 1-2 req/sec).
• Do not disclose vulnerabilities publicly before we have had a reasonable time to patch them (typically 90 days).
• Do limit your testing to your own accounts or accounts where you have explicit permission.

In-Scope Assets

• *.dhamanilink.com
• DhamaniLink Web Application (Next.js Edge)
• DhamaniLink Backend APIs (Supabase Edge Functions / Auth)

Out-of-Scope Vulnerabilities

The following types of reports are generally not eligible for reward unless they demonstrate a severe, exploitable impact:

• Clickjacking on pages with no sensitive actions.
• Missing HTTP security headers (e.g., Strict-Transport-Security, X-Frame-Options) without demonstrable impact.
• Reports indicating that our services do not fully align with "best practice" (e.g., missing DMARC/SPF/DKIM).
• Self-XSS (User tricking themselves into executing XSS).
• Issues related to third-party vendors (e.g., Vercel, Stripe, Pesapal, Supabase core infrastructure) should be reported directly to them.

Reporting a Vulnerability

Safe Harbor

We will not take legal action against you or ask law enforcement to investigate you if you comply with this Vulnerability Disclosure Policy. We consider activities conducted consistent with this policy to constitute "authorized" conduct.