This policy describes how VDHOSTS INTERNET PRIVATE LIMITED ("VD Hosts") handles vulnerabilities reported to us, and how we disclose vulnerabilities we discover in third-party products during our work. Reporting instructions are in our Responsible Disclosure Policy.
1. Triage and timelines
| Step | Target |
|---|---|
| Acknowledge a report | Within 3 working days |
| Initial assessment and severity rating (CVSS) | Within 10 working days |
| Fix for critical and high severity issues | As a priority, typically within 30 days |
| Fix for medium and low severity issues | In a planned release, typically within 90 days |
These are targets, not guarantees; we keep reporters informed if a fix will take longer.
2. Incidents
If a vulnerability has been exploited, we follow our incident response process, including reporting to CERT-In within six hours where the CERT-In Directions apply, and notifying affected clients and persons as required.
3. Vulnerabilities found during client work
Findings from security testing for a client are confidential to that client and are reported only to them. If we find a vulnerability in a third-party product during that work, we inform the client and, with their agreement, notify the vendor privately, allowing a reasonable period (generally 90 days) for a fix before any coordinated public disclosure. Where appropriate, we may also report to CERT-In or request a CVE identifier.
4. security.txt
Our security contact is published at /.well-known/security.txt in line with RFC 9116. Contact: info@vdhosts.com.