1. Introduction
Vansh Homes Appliances Pvt. Ltd. (“Vansh Homes”, “we”, “our”, or “us”) is committed to maintaining the security, integrity, and privacy of our customers, partners, and business operations.
We value the efforts of security researchers, ethical hackers, customers, and members of the security community who help identify and responsibly disclose potential security vulnerabilities. This Responsible Vulnerability Disclosure Policy outlines the process for reporting security issues and our commitment to handling such reports responsibly.
This policy applies to all digital assets owned and operated by Vansh Homes, including our website, web applications, and associated online services.
2. Scope
This policy applies to:
Examples of Vulnerabilities We Are Interested In
- Authentication and authorization issues
- Account takeover vulnerabilities
- Cross-Site Scripting (XSS)
- SQL Injection and other injection vulnerabilities
- Remote Code Execution (RCE)
- Server-Side Request Forgery (SSRF)
- Business logic vulnerabilities
- Privilege escalation
- Sensitive information disclosure
- API security vulnerabilities
- Security misconfigurations with demonstrated impact
3. Out of Scope
The following findings are generally considered out of scope unless accompanied by a demonstrable security impact:
- Missing SPF, DKIM, or DMARC records
- Missing security headers
- Clickjacking without sensitive impact
- Open redirects without security impact
- Self-XSS
- Best-practice recommendations without exploitability
- Vulnerabilities requiring physical access
- Social engineering attacks
- Phishing attempts
- Denial of Service (DoS/DDoS) testing
- Automated scanner reports without proof of exploitability
- Rate limiting concerns without demonstrated abuse
- Vulnerabilities in third-party services not controlled by Vansh Homes
4. Guidelines for Security Researchers
When conducting security research, you must:
You Must
- Act in good faith.
- Respect customer privacy and data confidentiality.
- Immediately stop testing if you encounter personal or sensitive customer information.
- Use the minimum amount of data necessary to demonstrate a vulnerability.
- Provide clear reproduction steps and evidence.
- Keep all vulnerability information confidential until remediation is completed.
- Comply with all applicable laws and regulations.
You Must Not
- Access, modify, delete, or disclose customer data.
- Perform Denial of Service (DoS/DDoS) attacks.
- Disrupt the availability of our services.
- Use social engineering against our employees, customers, vendors, or partners.
- Attempt to gain persistent access to systems.
- Upload malicious software, ransomware, or malware.
- Publicly disclose a vulnerability before obtaining written approval from Vansh Homes.
5. How to Report a Vulnerability
If you believe you have discovered a security vulnerability, please send a report to:
Email: support@vanshomeappliances.com
Please include the following information:
- Your name and contact information
- A detailed description of the vulnerability
- Impact assessment
- Affected URL, page, feature, or system
- Step-by-step instructions to reproduce the issue
- Screenshots, videos, logs, or proof-of-concept (PoC)
- Suggested remediation (optional)
Providing complete information helps us investigate and resolve issues more efficiently.
6. Our Commitment
Upon receiving a valid vulnerability report, we will:
- Acknowledge receipt within 5 business days.
- Review and validate the reported issue.
- Keep the reporter informed regarding the status of the investigation.
- Work to remediate confirmed vulnerabilities in a reasonable timeframe.
- Coordinate disclosure where appropriate.
- Recognize responsible researchers who contribute positively to our security efforts.
Resolution timelines may vary depending on the severity and complexity of the issue.
7. Safe Harbor
Vansh Homes Appliances Pvt. Ltd. supports responsible security research conducted in good faith.
We will not initiate legal action against researchers who:
- Comply with this policy.
- Avoid harming users, systems, and data.
- Report vulnerabilities privately and responsibly.
- Do not exploit vulnerabilities beyond what is necessary for validation.
This safe harbor applies only to activities conducted within the scope and requirements of this policy.
8. Public Disclosure
We request that researchers refrain from publicly disclosing vulnerabilities until:
- The issue has been investigated and resolved; or
- Written approval has been provided by Vansh Homes.
We believe coordinated disclosure helps protect our customers and business operations from potential exploitation.
9. Recognition
While Vansh Homes currently does not operate a monetary bug bounty program, we appreciate the efforts of responsible researchers.
At our discretion, we may provide:
- Appreciation emails
- Digital certificates of recognition
- Acknowledgment on our website or Hall of Fame page (subject to researcher consent)
10. Disclaimer
Vansh Homes reserves the right to modify this policy at any time without prior notice.
Submission of a vulnerability report does not create any contractual relationship between the reporter and Vansh Homes.
All vulnerability reports will be reviewed and assessed based on their severity, exploitability, and business impact.
Contact Information
Vansh Homes Appliances Pvt. Ltd.
Website:
https://vanshomeappliances.com
Security Contact:
support@vanshomeappliances.com
For all security-related concerns, vulnerability reports, and responsible disclosures, please contact our security team through the above email address.
