# Responsible disclosure — SanPan Studio Private Limited
#
# RFC 9116. Readiness clause S12.4: before this file existed, a security
# researcher's only route to us was a public one — a tweet, or an email to a
# sales address nobody triaged for severity.
#
# ⚠️ Expires is REQUIRED by RFC 9116 and an expired file is treated as invalid,
# so this date is checked weekly by .github/workflows/governance-cadence.yml and
# the scheduled job fails when it is within 30 days. Deliberately not a push gate:
# a date passing is not a commit's fault, and a gate with no path to pass gets
# bypassed.

Contact: mailto:security@indusarth.com
Expires: 2027-10-04T00:00:00.000Z
Preferred-Languages: en, hi
Canonical: https://www.indusarth.com/.well-known/security.txt
Policy: https://www.indusarth.com/privacy.html#responsible-disclosure

# What we commit to
#
#   · We acknowledge a report within 5 working days, from a person.
#   · We tell you our assessment of severity and our intended fix window.
#   · We will credit you when the fix ships, if you want to be credited.
#
# Safe harbour
#
# We will not pursue or support legal action against research conducted in good
# faith that stays within these limits:
#
#   · Test only against accounts and company workspaces you own or have written
#     permission to test. ⚠️ This product is multi-tenant: a probe that reaches
#     another company's data is someone's real business records, not a finding in
#     a lab. Stop at the first sign you have crossed a tenant boundary, and tell
#     us what you saw rather than how much more you could see.
#   · No denial of service, no load or stress testing, no spam, and no social
#     engineering of our staff, customers or vendors.
#   · Do not modify or delete data that is not yours, and do not retain, publish
#     or share any personal data you encounter. Report it and delete your copy.
#   · Give us a reasonable window to fix before disclosing publicly. Tell us if
#     you intend to publish, and when.
#
# Out of scope: findings from automated scanners with no demonstrated impact,
# missing headers with no exploit path, and reports about our marketing site's
# third-party CDN configuration.
#
# This text has not been reviewed by counsel — see
# docs/platform/governance/counsel-review-brief.md.