ZipZy® Vulnerability Disclosure Policy

Researchers who comply with this Policy can expect a professional, transparent, and collaborative response from our security team.

• Acknowledgement of valid reports within 2 business days.
• Initial assessment and triage within 5 business days.
• Reasonable progress updates throughout the remediation process.
• No legal action or support for legal action against researchers conducting authorised good-faith research within the scope of this Policy.
• Public acknowledgement of valid findings where the researcher wishes to be credited.
• Confidential handling of reports and researcher identities unless disclosure is required by law.

The following systems and services are within the scope of this Vulnerability Disclosure Policy:

• zipzy.in and official subdomains, including marketing, documentation, dashboard, and payment services.
• zpzy.in together with link resolution and QR infrastructure.
• Official ZipZy® APIs and webhook infrastructure.
• Official ZipZy® desktop and mobile applications.
• Official browser extensions, SDKs, and software published directly by Pranava Company Group.

Priority Vulnerabilities. We are particularly interested in reports involving authentication bypass, broken access control, privilege escalation, cross-tenant access, injection vulnerabilities, remote code execution, server-side request forgery (SSRF), account takeover, exposed credentials, stored cross-site scripting, CSRF affecting sensitive operations, business logic flaws, subdomain takeover, and vulnerabilities affecting AI Features.

Highest Priority. Cross-tenant data exposure or workspace isolation failures should be reported immediately.

Certain systems and findings fall outside the scope of this Policy and are generally not eligible for remediation or recognition under the Vulnerability Disclosure Program.

3.1 Systems

• Third-party services and infrastructure operated independently of Pranava Company Group.
• Customer-created landing pages, hosted content, and destination websites.
• Applications developed by third parties using the ZipZy® API.
• Any system not explicitly identified as in scope under Section 2.

3.2 Findings

• Missing security headers without demonstrated security impact.
• Email configuration observations without exploitable consequences.
• Self-XSS requiring users to execute their own code.
• Reports consisting solely of automated scanner output without manual validation.
• Software version disclosure without demonstrated exploitability.
• Rate-limiting suggestions for non-sensitive endpoints.
• Denial-of-service, stress testing, or volumetric attacks.
• Social engineering, phishing, or physical attacks against personnel.
• Issues requiring rooted, jailbroken, or unsupported devices.
• Behaviour that represents the intended operation of a URL shortener rather than a security vulnerability.

Security research must be conducted responsibly and with minimal impact on the availability, integrity, and confidentiality of the ZipZy® Services.

4.1 Permitted Activities

• Test only against accounts, resources, and data that you own or are authorised to access.
• Stop testing once you have confirmed the existence of a vulnerability.
• Use the minimum interaction necessary to demonstrate the issue.
• Report vulnerabilities promptly after discovery.
• Use a distinctive User-Agent string identifying your research so legitimate testing traffic can be distinguished from malicious activity.
• Keep findings confidential until coordinated disclosure has been agreed.

4.2 Prohibited Activities

• Do not access, modify, copy, exfiltrate, or retain Customer Data belonging to another person or organisation.
• Do not continue exploring systems after initial access has been demonstrated.
• Do not perform denial-of-service, stress testing, or resource exhaustion attacks.
• Do not execute high-volume automated scanning that negatively affects service availability.
• Do not perform brute-force attacks, credential stuffing, or password spraying against production accounts.
• Do not socially engineer employees, contractors, customers, or vendors.
• Do not attempt physical intrusion into facilities or infrastructure.
• Do not deploy malware, persistence mechanisms, shells, or backdoors.
• Do not modify, destroy, or deface production systems or data.
• Do not publicly disclose vulnerabilities before coordinated disclosure has been agreed.
• Do not demand payment or other consideration as a condition of disclosure.
• Do not intentionally test systems listed as out of scope.

Researchers acting in good faith and complying with this Policy are afforded the following safe harbour protections.

• Research conducted in accordance with this Policy is considered authorised for the limited purposes described herein.
• We will not initiate or support civil or criminal proceedings against researchers whose activities remain within the permitted scope.
• Where appropriate, we will communicate to third parties that the relevant research was authorised under this Policy.

5.1 Limitations. Safe harbour applies only to activities fully complying with this Policy. It does not extend to unauthorised access to Customer Data, service disruption, extortion, or testing outside the defined scope.

5.2 Good Faith. If you are uncertain whether planned testing is permitted, contact security@zipzy.in before proceeding. Seeking clarification in advance is considered strong evidence of good-faith research.

Submit vulnerability reports to security@zipzy.in with sufficient information to reproduce, validate, and remediate the issue.

1. A concise summary describing the vulnerability.
2. The vulnerability class and, where known, the applicable CWE identifier.
3. Affected URLs, API endpoints, application versions, or other impacted components.
4. Clear step-by-step reproduction instructions.
5. Proof-of-concept material such as requests, responses, screenshots, scripts, or short demonstration videos.
6. An explanation of the security impact and any assumptions or prerequisites.
7. Your proposed severity assessment, including CVSS information where available.
8. Suggested remediation, where appropriate.
9. Your preferred contact details and attribution information.
10. Any intended public disclosure timeline.

6.1 Secure Submission. Researchers requiring encrypted communication may request our PGP public key by contacting security@zipzy.in.

6.2 Separate Reports. Submit unrelated vulnerabilities separately. Multiple vulnerabilities forming a single exploit chain may be included within the same report.

6.3 Language. English is the preferred language for vulnerability reports.

6.4 Duplicate Reports. Where multiple researchers independently report the same issue, recognition is generally based on the first complete and reproducible report received.

Our target response times for valid vulnerability reports are shown below.

Critical vulnerabilities affecting Customer security or platform integrity are prioritised immediately, including outside normal business hours where appropriate.

We use CVSS v3.1 as the primary framework for assessing reported vulnerabilities, together with practical exploitability, customer impact, business risk, and environmental factors specific to the ZipZy® platform.

Where our assessment differs from the researcher's proposed severity, we will explain the reasoning and remain open to additional technical evidence.

Target remediation timeframes vary according to the assessed severity of the vulnerability.

Where architectural complexity or operational constraints prevent meeting these targets, we implement appropriate compensating controls where practical, communicate revised timelines, and continue providing progress updates until remediation is complete.

We strongly encourage coordinated disclosure so vulnerabilities can be remediated before public disclosure increases risk to Customers.

10.1 Disclosure Timing. Researchers are requested not to publicly disclose vulnerabilities until a fix has been deployed or 90 days have elapsed since the initial report, whichever occurs first.

10.2 Collaboration. We are happy to coordinate disclosure dates and review draft technical write-ups for factual accuracy. We will not request removal of accurate technical information solely because it is critical of our implementation.

10.3 Customer Protection. Where vulnerabilities affect a significant number of Customers, we may request a limited extension to allow notification and deployment of protective measures before public disclosure.

10.4 Sensitive Information. Public disclosures must never contain Customer Personal Data, authentication credentials, API secrets, private cryptographic material, or other confidential information.

10.5 Security Advisories. Where appropriate, we publish security advisories and directly notify affected Customers in accordance with our Security Policy.

We value responsible disclosure and appreciate the efforts of security researchers who help improve the security of the ZipZy® platform.

11.1 Public Recognition. With your permission, we may acknowledge valid reports on a public security acknowledgements page using your preferred name, handle, or organisation.

11.2 Confirmation Letter. Upon request, we may provide written confirmation recognising your responsible disclosure for professional or academic purposes.

11.3 Rewards. We do not currently operate a formal bug bounty programme. Exceptional findings may receive discretionary recognition or rewards at our sole discretion. Any such reward is voluntary and does not create any ongoing entitlement.

11.4 Eligibility. Recognition and discretionary rewards are available only for reports submitted in compliance with this Policy. Reports involving prohibited activities, coercion, or extortion are not eligible.

If, during authorised security research, you inadvertently access information belonging to another person or organisation, you must minimise further exposure and protect the confidentiality of that information.

1. Stop immediately. Do not continue exploring, enumerating, or interacting with the affected data after confirming the issue.
2. Do not retain data. Do not copy, download, distribute, or store Customer Personal Data or confidential information.
3. Record only what is necessary. Collect only the minimum evidence required to demonstrate the vulnerability, using redacted examples wherever possible.
4. Notify us promptly. Include details of the accidental exposure within your vulnerability report, including the approximate amount and type of information encountered.
5. Delete temporary copies. Securely delete any temporary evidence once we acknowledge receipt of your report and confirm that sufficient information has been received.

Accessing substantially more data than necessary or intentionally retaining Customer Personal Data falls outside the protections of this Policy and may constitute a personal data breach.

Some services supporting the ZipZy® platform are operated by independent third-party providers.

If you discover a vulnerability affecting one of those providers, you should report it directly through that provider's own vulnerability disclosure programme while also informing us so we can assess any potential impact on the ZipZy® Services.

Our Safe Harbour protections do not extend to testing third-party infrastructure without the express authorisation of the relevant provider.

We may revise this Vulnerability Disclosure Policy from time to time to reflect changes in technology, legal requirements, operational practices, or our security programme.

The version of this Policy in effect when security research begins generally governs that research. Material updates normally become effective 30 days after publication unless immediate changes are necessary to protect the Services or comply with legal obligations.

Postal Address
Pranava Company Group (ZipZy®)
62, Mandola, Loni
Ghaziabad, Uttar Pradesh 201102
Bharat (India)

Related Policies: Security Policy • Acceptable Use Policy • Terms of Service • Compliance Statement.

We appreciate responsible security research and remain committed to working collaboratively with researchers to identify, validate, and remediate vulnerabilities that improve the security of the ZipZy® platform.