VDHOSTS INTERNET PRIVATE LIMITED ("VD Hosts") welcomes reports from security researchers who find vulnerabilities in our systems. This policy explains how to report them and what we commit to in return.
1. How to report
Email info@vdhosts.com with: a description of the issue and its impact, the affected URL or component, steps to reproduce, and any proof-of-concept. Please do not include personal data you may have accessed. We also publish our security contact in /.well-known/security.txt.
2. Scope
- In scope: vdhosts.com and its subdomains operated by VD Hosts, and the VD Hosts client area.
- Out of scope: websites and systems we build or manage for clients (report those to the client, or to us only with the client's permission); third-party services we use; associated brands' separate websites unless stated; denial-of-service, social engineering, physical attacks and spam.
3. Rules of engagement
- Test only against accounts you own or have permission to use.
- Do not access, modify, delete or retain data that is not yours; stop and report as soon as you see someone else's data.
- Do not degrade service availability; avoid automated scanning at volume.
- Give us reasonable time (we suggest 90 days) to fix the issue before disclosing it publicly, and coordinate disclosure with us.
- Comply with all applicable laws.
4. Our commitment
- We will acknowledge your report, usually within 3 working days, and keep you updated on progress.
- We will not pursue legal action against researchers who act in good faith and follow this policy, and we will treat such research as authorised for the purpose of our own systems. This does not authorise testing of third-party or client systems.
- With your permission, we will credit you once the issue is fixed.
We do not currently run a paid bug bounty programme.