Vulnerability Disclosure
What you may test, how to do it responsibly, and how to report a security weakness to us.
Version 1.0 · Last updated: 2 October 2026 · Dallas, Texas, United States
1. Scope and Rules of Engagement
We welcome reports from security researchers who find a weakness and tell us about it responsibly. This policy sets out what you may test and how; there is no paid bounty.
In scope
- The public website at https://www.hemasai.com and its API under the same domain.
- Authentication, session handling and authorisation, including the administration area's sign-in.
- Injection, cross-site scripting, cross-site request forgery, access control and data exposure weaknesses.
Out of scope
- Denial-of-service testing, load generation or high-volume automated scanning.
- Social engineering, phishing, or physical attacks against people or premises.
- Services we do not operate, including Amazon Web Services, Google, Microsoft, LinkedIn and our domain registrar.
- Reports from automated tools without a demonstrated, reproducible impact.
Rules of engagement
- Test only as much as needed to demonstrate the issue, and stop as soon as you have.
- Do not access, change, keep or share data that is not yours. If you encounter personal data, stop, do not copy it, and tell us.
- Do not degrade the Site's availability or other visitors' use of it, and respect its rate limits.
- Do not attempt to bypass the administration area's network or multi-factor restrictions by guessing or reusing credentials.
- Give us a reasonable time to fix the issue before disclosing it publicly, and coordinate the disclosure date with us.
How the Site is protected is described in the Security Policy.
2. Safe Harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, will not pursue or support legal action against you for it, and will tell anyone who complains that the research was authorised. If you are unsure whether something is allowed, ask us first.
This safe harbour covers only our own systems and claims we could bring. We cannot authorise testing of third-party services or bind third parties or authorities, and it does not cover conduct that breaks this policy or the law.
3. How to Report
Email a description of the issue, the affected address, step-by-step instructions to reproduce it, and its impact. Do not include other people's personal data in the report.
4. What Happens Next
- We acknowledge a complete report within 7 business days.
- We investigate, keep you informed of progress, and tell you when the issue is fixed.
- With your permission, we credit you when the fix is public.
Maintained by Hema Sai Mallampati · Version 1.0 · Last updated: 2 October 2026 · Dallas, Texas, United States