Responsible Disclosure Policy

Vext Audit Capital takes the security of our systems and client data with the utmost seriousness. This Responsible Disclosure Policy governs how security vulnerabilities in our systems may be reported and the terms under which security research is authorised. It must be read alongside the critical legal notice in Section 4 before conducting any testing.

1. Scope

This policy covers: vextaudit.com and all subdomains; publicly accessible API endpoints operated by the Firm; and email infrastructure configuration (SPF, DKIM, DMARC). It does not cover third-party services (Google, Razorpay, Vercel, Make.com; report those to the respective provider) or client systems (governed by engagement letters).

2. Pre-authorisation requirement

Active testing of the Firm's systems requires written pre-authorisation before any testing commences. To obtain pre-authorisation, email support@vextaudit.com with subject "Security Testing Pre-Authorisation Request", describing: the systems you intend to test; the testing methodology; the tools you intend to use; and your contact details. The Firm will respond within 3 Business Days with either written authorisation specifying the permitted scope and duration, or a written declination.

Passive observation of publicly accessible pages using a standard browser does not require pre-authorisation. All other testing, including but not limited to automated scanning, fuzzing, injection testing, authentication bypass attempts, and API testing, all require written pre-authorisation regardless of intent.

Testing without pre-authorisation is not covered by the safe harbour in Section 4 and may constitute an offence under Section 66 of the Information Technology Act 2000.

3. Conduct during authorised research

Authorised researchers must:

• Conduct testing only within the scope specified in the pre-authorisation
• Not access, copy, modify, delete, or exfiltrate any data beyond what is minimally necessary to demonstrate the vulnerability
• Not conduct denial of service attacks or generate load that disrupts normal operations
• Not introduce malware or destructive code
• Not conduct social engineering or phishing against Firm personnel, clients, or service providers
• Not test against accounts, data, or systems belonging to any other user or client
• Report findings to support@vextaudit.com promptly and not disclose to any third party before the Firm has remediated the vulnerability

4. Safe harbour: civil matters only, criminal liability not affected

5. The Firm's response commitments

• Acknowledgement within 24 hours of receiving a valid vulnerability report
• Initial assessment within 3 Business Days confirming validity and scope
• Progress updates at least every 7 days until resolution
• Remediation targets: Critical: 14 days; High: 30 days; Medium: 60 days; Low: 90 days
• Coordinated disclosure at an agreed date after remediation
• Credit acknowledgement with the researcher's permission

6. Out-of-scope activities

The following are explicitly excluded from this policy and may result in criminal and civil legal proceedings regardless of intent:

• Any testing without written pre-authorisation
• Accessing, downloading, or exfiltrating any data not belonging to the researcher
• Denial of service attacks of any kind
• Introduction of malware or destructive code
• Social engineering of Firm personnel, clients, or service providers
• Physical access attempts to Firm premises or devices
• Testing against other users' accounts or client data

7. Contact