Coordinated Vulnerability Disclosure

Vulnerability Responsible Disclosure

We value the cybersecurity research community. If you discover a potential vulnerability in any TrustLayerLabs system or asset, we encourage you to report it to us immediately.

Safe Harbor & Legal Protection

TrustLayerLabs considers good-faith vulnerability research conducted in accordance with this policy to be authorized. If you discover a security vulnerability and follow these guidelines, we will not initiate or pursue legal action against you, nor will we request law enforcement investigation for accidental security boundary tests.

Program Scope & Assessment Boundaries

Only vulnerabilities within the declared scope qualify for coordinated disclosure.

In-Scope Assets & Flaws

Domain: *.trustlayerlabs.co.in web applications & public APIs
Authentication & Session Management flaws (JWT manipulation, token leakage)
Broken Object Level Authorization (BOLA/IDOR)
Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE)
SQL Injection, NoSQL Injection, and Command Injection

Out-of-Scope Activities

Denial of Service (DoS / DDoS) attacks or resource exhaustion
Phishing, spear-phishing, or social engineering targeting our staff
Physical attacks against data centers or offices
Automated high-frequency scanning without rate limits
Third-party services (DNS, Vercel infrastructure, email providers)

Reporting Guidelines & Response SLAs

Please submit detailed technical reports to Contact TrustLayerLabs. To accelerate verification, adhere to the following standards:

Detailed Reproduction:Include HTTP requests/responses, payload parameters, or minimal PoC scripts.

Data Minimization:Prove exploitation non-destructively. Never exfiltrate data beyond verifying the flaw.

24-Hour Acknowledgement:We acknowledge receipt within 24 hours and triage severity (CVSS v3.1) within 72 hours.

30-Day Window:We request a 30-day remediation window prior to public disclosure of vulnerability details.

Researcher Recognition

While TrustLayerLabs does not currently operate a paid bug bounty program, we believe in honoring security contributors. Researchers who report qualifying, previously unknown vulnerabilities in good faith will receive public acknowledgment in our Security Hall of Fame and a formal professional recommendation on LinkedIn.