How to report
Email info@cybzilla.com with "Security report" in the subject. Include the affected URL or system, a description of the issue and its impact, and the steps needed to reproduce it. Our machine-readable contact details are in security.txt.
Scope
This policy covers www.cybzilla.com, cybzilla.com, and other systems operated by Cybzilla. Third-party services we use, such as our hosting and email providers, are covered by their own disclosure programmes. Systems we operate for clients are covered by the client's own policy.
Rules for good-faith research
- Do not run denial-of-service tests, high-volume automated scans, or anything that degrades the service for others.
- Access, change, or delete no more data than the minimum needed to show the issue. If you encounter personal data, stop, do not keep it, and tell us.
- Do not use social engineering, phishing, or physical attacks against our staff, offices, or clients.
- Give us reasonable time to fix the issue before you disclose it publicly, and do not share it with anyone else in the meantime.
Our commitments
- We will acknowledge your report within three working days and keep you informed as we investigate and fix it.
- We will not take legal action against you for research that follows this policy in good faith, and we will treat your report as authorised for that purpose.
- With your permission, we will credit you once the issue is resolved.
We do not currently run a paid bug bounty programme. Cybersecurity incidents are reported to CERT-In as Indian law requires.