Security

Responsible disclosure

RYSAG carries dealers' licence documents, vendors' bank details and every rupee that moves through the marketplace. If you have found a way to reach something you should not, we want to hear about it before anyone else does.

How to report

Email security@rysag.com. Please include:

The affected URL, endpoint or app screen, and the account type you were signed in as.
Steps to reproduce, in order. A short screen recording is worth a page of prose.
What an attacker gets out of it — that is what decides how fast we move.
Whether any other party knows, and any date by which you intend to publish.

Reports are accepted in English. Our machine-readable contact record is published at /.well-known/security.txt (RFC 9116).

What we commit to

Acknowledgement: Within 2 business days, from a human, not an auto-reply.
Triage and severity: Within 5 business days, with our assessment and the reasoning behind it.
Progress updates: At least every 14 days until the report is closed.
Fix: Critical and high findings are patched on a priority release; everything else on the normal cycle.
Credit: Named acknowledgement once the fix has shipped, if you would like it.

RYSAG does not currently run a paid bug bounty. We say so plainly rather than leaving it ambiguous — reports are still triaged and fixed with the same urgency, and credited if you want the credit.

Safe harbour

If you make a good-faith effort to follow this policy, RYSAG INDIA PRIVATE LIMITED will treat your research as authorised, will not pursue or support legal action against you over it, and will say so if a third party raises the matter with us.

Good faith means, concretely:

You test only against accounts you own or have permission to use.
You stop at proof. One record is proof; downloading a table is not.
You do not degrade the service, delete or alter data, or hold anything to ransom.
You give us a reasonable window to fix the issue before publishing.

If you are unsure whether a test crosses one of these lines, ask us first at security@rysag.com. We would much rather answer that question than read about it afterwards.

Scope

In scope

rysag.com and every subdomain, including vendor storefronts
The public API under /api/v1
The RYSAG and RYSAG Sellers mobile apps

Out of scope

Volumetric or denial-of-service testing of any kind
Findings that need a rooted or jailbroken device
Social engineering of staff, dealers or vendors
Physical access, and third-party services we merely consume
Missing hardening headers with no demonstrated impact

Not a security issue?

A problem with an order, a payment, a licence or a listing goes through support, not here — that route can see your account and this one deliberately cannot. Use the contact page. If you believe your account has been taken over, say so in the subject line and we will treat it as urgent.