1.Intent
Protecting customer data matters to us. We welcome good-faith reports of vulnerabilities and will work with you to fix them.
2.Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, will not initiate legal action against you, and will work to resolve the issue. This does not bind third parties; if a third party takes action we will say your work was authorised. Safe harbour does not apply to activity that harms users or breaks other laws.
3.Scope
In scope: digai.in; the DigAI dashboard at app.digai.in; the DigAI API (api.digai.in) including public API keys; the DigAI mobile apps; SSO/SAML endpoints; public embeddable assets we serve (chat widget, form and booking loaders); published customer-facing pages we host, where the flaw is in our platform rather than the customer's content.
Out of scope: third-party services (Meta, Google, payment gateways, AI providers, hosting); customers' own sites and content; social engineering, phishing or physical attacks against staff or customers; denial-of-service or volumetric testing; spam or message flooding; automated scanner output without a working proof of concept; missing best-practice headers or cookie flags without a demonstrated impact; vulnerabilities requiring a rooted device or outdated browser; software version banners.
4.Rules of engagement
- Test only accounts you own or have permission to use. Create your own trial account; do not target other customers' organizations.
- Stop and report as soon as you reach another person's data; don't view, copy, modify or keep it beyond what is needed to show the issue.
- No destructive actions, data loss, service degradation, persistence or pivoting.
- Don't send unsolicited messages through the WhatsApp, email or SMS features.
- Keep details private until we agree on disclosure.
5.How to report
Email security@digai.in (for encrypted reports use the PGP details on this page). Include: affected URL/endpoint, clear steps to reproduce, proof of concept, impact, your tools and your preferred name for acknowledgement. Do not include real personal data.
6.What to expect
- Acknowledgement within 24 hours.
- Triage and severity within 72 hours.
- Updates at least every 14 days until resolution.
- Fix targets: critical 7 days, high 30 days, others as scheduled.
- We will tell you when it is fixed and, with your consent, credit you.
7.Coordinated disclosure
Please allow us up to 90 days from your report to fix the issue before publishing. We may ask to extend for complex issues and will agree a date with you.
8.Rewards
We do not currently run a paid bug bounty. We offer public acknowledgement in our Hall of Thanks (with your permission).
9.Legal and regulatory notes
We may share information with Indian authorities such as CERT-In where required by law (including incident-reporting directions) and will do so in a way that avoids exposing you where possible.
10.Hall of thanks
(No entries yet.)
DigAI Safe Harbour Agreement
We pledge not to pursue civil litigation, issue takedown notices, or initiate criminal complaints against security researchers who investigate our systems in good faith, avoid privacy violations, and adhere to the guidelines set out in this policy.
Research Scope Matrix
Strict targets eligible for testing and responsible vulnerability disclosure.
| Target Asset | Scope Status | Category | Rules / Notes |
|---|---|---|---|
| digai.in | In Scope | Primary Marketing & Documentation Web Application | Includes all public pages, pricing, documentation, and blog. |
| app.digai.in | In Scope | Customer Dashboard & Web Application | Authentication, CRM workflows, Unified Inbox, and admin settings. |
| api.digai.in | In Scope | Core Platform REST & WebSocket APIs | Inbound webhooks, sender dispatch endpoints, and partner integrations. |
| Third-party vendor infrastructure (Meta WhatsApp, Razorpay) | Out of Scope | External Subprocessors | Please report issues directly to Meta Bug Bounty or Razorpay Security. |
| Social engineering, phishing, or physical attacks | Out of Scope | Non-technical attack vectors | Physical office access, staff phishing, and voice phishing are strictly prohibited. |
| Denial of Service (DoS/DDoS) and volume flood tests | Out of Scope | Volumetric Attacks | Attacks that degrade service availability for legitimate users are prohibited. |
Encrypted Reporting (PGP)
For sensitive zero-day submissions, please encrypt your payload using our public PGP key.
Response SLA Commitments
- Initial Acknowledgement
- < 24 Hours
- Initial Severity Triage
- < 72 Hours
- Remediation Updates
- Every 7 Calendar Days
Submit a Vulnerability Report
Reports are handled under strict confidentiality. You may report anonymously if desired.
Security Hall of Thanks
We honor independent security researchers who responsibly report verified vulnerabilities. Qualifying reports will be credited here upon remediation.
No external advisories published yet. Be the first to help secure our infrastructure.