Security and responsible disclosure
People trust this portal with some of the most sensitive things they'll ever say at work. If you find a security problem, please tell us first and give us time to fix it.
How to report a problem
Email [email protected] with what you found, how to reproduce it, and what someone could do with it. Screenshots or a short video help. You can write in English or Hindi.
This address is also published in /.well-known/security.txt.
What we promise
- We reply within 2 working days and keep you updated.
- We aim to fix critical problems within 7 days and others within 30 days.
- We'll credit you when it's fixed, if you want.
- We won't take legal action against good-faith research that follows the rules below.
Rules for testing
- Test only against the demo portal or your own account. Never against a real company's portal.
- Never try to find out who filed a report, and never open, copy or keep anyone's report, messages or files. If you see personal data by accident, stop, tell us and delete it.
- No denial of service, spam, social engineering or physical attacks.
- Give us a reasonable time to fix the problem before you talk about it publicly.
In scope
The SpeakUpSafe web app, its APIs (including the reporting API, SCIM and webhooks), sign-in and the kiosk.
Out of scope
Problems that need a stolen device or account, reports from automated scanners with no proof of impact, missing headers that don't lead to a real attack, and services run by others (such as the database host or email provider), which should be reported to them.
For a security incident affecting your company's data, also tell your company's speak-up team. India's CERT-In and the Data Protection Board are told within the legal time limits.