Responsible disclosure

Security policy

We hold ourselves to the same standard we bring to evidence work: careful, honest and documented. If you find a problem in FORENSYRA, tell us privately — we will treat it seriously and tell you exactly where it stands.

Report a vulnerability

Please do not open a public issue for a security problem. Use one of these private channels:

Include what the issue is and where it lives, steps to reproduce or a proof-of-concept, the impact you believe it has, and how you would like to be credited.

What to expect

Response targets for security reports
Stage	Target
We acknowledge your report	within 3 working days
Initial assessment and severity	within 7 working days
Fix or mitigation plan	within 30 days for high/critical

We are a volunteer collective, so these are best-effort targets rather than a contractual guarantee. We will not go quiet on you — if something will take longer, we will say so.

Scope

In scope

forensyra.in and its subdomains, and this repository
The contact, application and mentor forms and their API routes
Anything that leaks private data or bypasses validation
Anything that lets one visitor affect another

Out of scope

Denial-of-service and volumetric attacks
Social engineering of members
Vulnerabilities in third-party services — report those upstream
Findings that require a compromised device, browser extension or account

Our commitments

We will not pursue or support legal action against researchers who act in good faith, stay within scope, avoid privacy violations and data destruction, and give us reasonable time to fix the issue before disclosure.
We will not offer payment — we have no bug bounty budget. We will credit you in the fix, if you would like.
Never include real case material, personal data, credentials or evidence in a report. If a proof-of-concept needs data, use synthetic values.

Stage

Target

We acknowledge your report

within 3 working days

Initial assessment and severity

within 7 working days

Fix or mitigation plan

within 30 days for high/critical