Vulnerability disclosure policy

1. Our commitment

Deyora Intelligence Private Limited builds DokyDoc. We want to hear about security weaknesses in it, and we will work with anyone who reports one in good faith. This page says how to report, what we promise in return, and what is in and out of scope.

2. How to report

Email [email protected], with “Security” in the subject. Please write in English. If you get no acknowledgement within 3 business days, please write again.

Please include:

• the affected URL, API endpoint or feature;
• the type of weakness and its impact as you see it;
• step-by-step instructions to reproduce it, with a working demonstration, screenshots or a short video if they help;
• the name of the DokyDoc organisation you tested with, and the dates, times (with time zone) and IP addresses of your testing, so we can tell your traffic from an attack;
• whether you saw, kept or changed any data that is not yours;
• how you would like to be credited, if at all.

Do not send other people’s personal data or customer content in your report. Describe it instead.

3. What we promise

We will not share your identity outside the company without your permission, except where the law requires it.

4. Scope

In scope:

• the DokyDoc application at https://dokydoc.com and https://www.dokydoc.com, including its API under /api/;
• the company website at https://deyoraintelligence.com, for weaknesses in the site itself.

You may create your own organisation in DokyDoc to test with. Test only against accounts and organisations you created. To test isolation between organisations, create two.

AI features are in scope where a weakness lets someone reach another organisation’s data or perform an action the user did not authorise (for example through prompt injection). The quality or accuracy of AI output is not a security issue; please send that to support.

Out of scope:

• denial of service, load or stress testing, and anything that degrades the service for others;
• social engineering or phishing of our staff, customers or suppliers;
• physical attacks on offices, data centres or devices;
• the services of the providers on our Sub-processor and Connector List, the services our customers connect, and the platform that hosts our website: please report to them directly;
• output from automated scanners without a demonstrated, exploitable impact;
• missing security headers, banner or version disclosure, or email SPF/DKIM/DMARC settings, without a demonstrated impact;
• clickjacking on pages with no sensitive action, self-XSS, and logout CSRF;
• rate limits on endpoints that are not sensitive;
• issues that need an outdated browser or a compromised device;
• limitations we already state on DokyDoc’s /security page.

5. Rules for testing

• Use only accounts and organisations you own. If you reach data that is not yours, stop, do not keep or share it, and tell us in your report.
• Do not change or delete data that is not yours.
• Keep automated requests below 5 per second, and do not run tests that could affect other customers.
• Do not try to obtain paid credit or services without paying; report the weakness instead.
• Do not leave backdoors, persistence or malware.
• Delete any data you obtained once you have reported.
• Keep the details confidential until we agree a disclosure date (§6).
• Do not ask for payment or any other benefit in return for not disclosing a weakness.
• Follow Indian law and the law where you are.

6. Coordinated disclosure

We ask you to wait 90 days from your report, or until the fix is live if that is sooner, before publishing details. We may agree a longer period for a complex fix, and we will tell you why. If the weakness is being exploited, we will work with you on an earlier joint disclosure. We are happy to publish our own advisory and credit you by name.

7. Safe harbour

If you make a good-faith effort to follow this policy, then for the research you do under it:

• You have our permission. Deyora Intelligence Private Limited, as the person in charge of the systems in §4, permits you to access and test them within the scope in §4 and the rules in §5. This is our permission for the purposes of section 43 of the Information Technology Act, 2000.
• No civil claim. We will not bring a civil claim against you, including a claim for compensation under section 43 of the Information Technology Act, 2000 or a claim for breach of our Terms of Service.
• No complaint. We will not file a police complaint, a first information report or any other complaint against you with any authority.
• Terms of Service. Testing that follows this policy is not a breach of the Terms of Service (“Acceptable use”), which forbid probing, scanning or testing DokyDoc’s security “without Deyora’s written permission”: this policy is that written permission.
• If someone else acts. If a third party makes a claim or complaint against you about research that followed this policy, we will confirm in writing, on request, that we permitted it.

What this cannot do. This is our own undertaking. It does not waive any criminal liability, which is a matter for the State and not for us, and it does not bind the police, CERT-In, courts, regulators, our customers or our suppliers. It covers only our own systems in §4; we cannot give permission to test the third-party services listed there. It does not cover research that breaks the rules in §5, that goes beyond what is needed to show the weakness, or that accesses, keeps, changes or discloses data that is not yours beyond that.

Our legal duties continue. Indian law may require us to report certain cyber incidents to CERT-In within 6 hours of noticing them, to tell affected customers when their data may have been exposed, and to answer lawful requests from authorities. If your report shows such an incident, we will make the report. In it we will describe your research as done with our permission and in good faith, and we will not give your name unless the law requires it or you agree.

8. Rewards

We do not run a bug bounty and do not pay for reports. With your permission, we will thank you by name in our advisory and in an acknowledgements list on this page.

Acknowledgements. None yet.

9. How we handle a report internally

Each report is recorded in the vulnerability register and handled under our vulnerability and patch management policy (triage, CVSS rating, remediation windows). If it shows that customer data may have been exposed, our incident response plan starts at once, including customer notice and the CERT-In report.

10. /.well-known/security.txt

The same contact details are published in machine-readable form (RFC 9116) at https://deyoraintelligence.com/.well-known/security.txt, served over HTTPS as text/plain, with its own Canonical line. Expires is set less than one year after publication, as the RFC recommends, and renewed at each yearly review. The file reads:

Contact: mailto:[email protected]
Expires: 2027-09-29T18:29:59.000Z
Preferred-Languages: en
Policy: https://deyoraintelligence.com/security/disclosure
Canonical: https://deyoraintelligence.com/.well-known/security.txt