Security & vulnerability disclosure

• Email: security@cognoshift.in (preferred — PGP key at /.well-known/cognoshift-pgp.asc when published)
• Fallback: support@cognoshift.in
• Machine-readable: /.well-known/security.txt

We respond to initial reports within 2 working days. Critical issues get a triage decision and remediation plan within 5 working days.

In scope

• ✓The Sanad portal at sanad.cognoshift.in and its public APIs.
• ✓The Sanad Sentinel agent binaries published under github.com/anupam9091/cognoshift-sentinel-dist.
• ✓Authentication / authorisation, RLS bypass, cookie-bridge, license-key handling.
• ✓Cryptographic chain integrity (Ed25519, SHA-256 chain).
• ✓Data residency / cross-tenant data leakage.

Out of scope

• ✗Denial-of-service / volumetric attacks. Rate-limit testing OK on a single IP, please don't go further.
• ✗Physical attacks, social engineering of staff.
• ✗Public information leakage (e.g. headers / framework banners) without a working exploit.
• ✗Vulnerabilities in 3rd-party services (Supabase, Vercel, Razorpay, Resend) — please report to those vendors directly.

Disclosure process

1. You email security@cognoshift.in with reproduction steps + impact analysis.
2. We acknowledge within 2 working days.
3. We triage, classify (CVSS), and propose a remediation timeline within 5 working days.
4. We patch, deploy, and verify with you that the fix works.
5. After 90 days (or sooner with mutual agreement) you may publish a write-up. We can co-disclose.
6. If the issue is critical and remediation requires longer than 90 days, we'll explain why and request an extension.

Researchers who responsibly disclose verified vulnerabilities are credited here (with their permission). The first ten reports earn a Sanad-branded shipped acknowledgment + a small token of appreciation. After that we will design a structured bounty programme.

No reports yet. Be the first.