Responsible Vulnerability Disclosure Policy

1. Introduction

Vansh Homes Appliances Pvt. Ltd. (“Vansh Homes”, “we”, “our”, or “us”) is committed to maintaining the security, integrity, and privacy of our customers, partners, and business operations.

We value the efforts of security researchers, ethical hackers, customers, and members of the security community who help identify and responsibly disclose potential security vulnerabilities. This Responsible Vulnerability Disclosure Policy outlines the process for reporting security issues and our commitment to handling such reports responsibly.

This policy applies to all digital assets owned and operated by Vansh Homes, including our website, web applications, and associated online services.

2. Scope

This policy applies to:

  • https://vanshomeappliances.com
  • All subdomains owned and operated by Vansh Homes
  • Customer-facing web applications and services operated by Vansh Homes

Examples of Vulnerabilities We Are Interested In

  • Authentication and authorization issues
  • Account takeover vulnerabilities
  • Cross-Site Scripting (XSS)
  • SQL Injection and other injection vulnerabilities
  • Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • Business logic vulnerabilities
  • Privilege escalation
  • Sensitive information disclosure
  • API security vulnerabilities
  • Security misconfigurations with demonstrated impact

3. Out of Scope

The following findings are generally considered out of scope unless accompanied by a demonstrable security impact:

  • Missing SPF, DKIM, or DMARC records
  • Missing security headers
  • Clickjacking without sensitive impact
  • Open redirects without security impact
  • Self-XSS
  • Best-practice recommendations without exploitability
  • Vulnerabilities requiring physical access
  • Social engineering attacks
  • Phishing attempts
  • Denial of Service (DoS/DDoS) testing
  • Automated scanner reports without proof of exploitability
  • Rate limiting concerns without demonstrated abuse
  • Vulnerabilities in third-party services not controlled by Vansh Homes

4. Guidelines for Security Researchers

When conducting security research, you must:

You Must

  • Act in good faith.
  • Respect customer privacy and data confidentiality.
  • Immediately stop testing if you encounter personal or sensitive customer information.
  • Use the minimum amount of data necessary to demonstrate a vulnerability.
  • Provide clear reproduction steps and evidence.
  • Keep all vulnerability information confidential until remediation is completed.
  • Comply with all applicable laws and regulations.

You Must Not

  • Access, modify, delete, or disclose customer data.
  • Perform Denial of Service (DoS/DDoS) attacks.
  • Disrupt the availability of our services.
  • Use social engineering against our employees, customers, vendors, or partners.
  • Attempt to gain persistent access to systems.
  • Upload malicious software, ransomware, or malware.
  • Publicly disclose a vulnerability before obtaining written approval from Vansh Homes.

5. How to Report a Vulnerability

If you believe you have discovered a security vulnerability, please send a report to:

Email: support@vanshomeappliances.com

Please include the following information:

  • Your name and contact information
  • A detailed description of the vulnerability
  • Impact assessment
  • Affected URL, page, feature, or system
  • Step-by-step instructions to reproduce the issue
  • Screenshots, videos, logs, or proof-of-concept (PoC)
  • Suggested remediation (optional)

Providing complete information helps us investigate and resolve issues more efficiently.

6. Our Commitment

Upon receiving a valid vulnerability report, we will:

  • Acknowledge receipt within 5 business days.
  • Review and validate the reported issue.
  • Keep the reporter informed regarding the status of the investigation.
  • Work to remediate confirmed vulnerabilities in a reasonable timeframe.
  • Coordinate disclosure where appropriate.
  • Recognize responsible researchers who contribute positively to our security efforts.

Resolution timelines may vary depending on the severity and complexity of the issue.

7. Safe Harbor

Vansh Homes Appliances Pvt. Ltd. supports responsible security research conducted in good faith.

We will not initiate legal action against researchers who:

  • Comply with this policy.
  • Avoid harming users, systems, and data.
  • Report vulnerabilities privately and responsibly.
  • Do not exploit vulnerabilities beyond what is necessary for validation.

This safe harbor applies only to activities conducted within the scope and requirements of this policy.

8. Public Disclosure

We request that researchers refrain from publicly disclosing vulnerabilities until:

  • The issue has been investigated and resolved; or
  • Written approval has been provided by Vansh Homes.

We believe coordinated disclosure helps protect our customers and business operations from potential exploitation.

9. Recognition

While Vansh Homes currently does not operate a monetary bug bounty program, we appreciate the efforts of responsible researchers.

At our discretion, we may provide:

  • Appreciation emails
  • Digital certificates of recognition
  • Acknowledgment on our website or Hall of Fame page (subject to researcher consent)

10. Disclaimer

Vansh Homes reserves the right to modify this policy at any time without prior notice.

Submission of a vulnerability report does not create any contractual relationship between the reporter and Vansh Homes.

All vulnerability reports will be reviewed and assessed based on their severity, exploitability, and business impact.

Contact Information

Vansh Homes Appliances Pvt. Ltd.

Website: https://vanshomeappliances.com

Security Contact: support@vanshomeappliances.com

For all security-related concerns, vulnerability reports, and responsible disclosures, please contact our security team through the above email address.