Responsible Vulnerability Disclosure

Find the Flaw. Protect the Future.

We believe in open collaboration with global security researchers. Help us safeguard our learning infrastructure and student platform.

Submit Vulnerability View Program Scope

shield

Safe Harbor & Responsible Disclosure

We commit not to pursue legal action against researchers acting in good faith within program scope.

Submit Bug Report

Rewards & Tiers

Eligible Vulnerabilities & Severity Classes

Bounties and Hall of Fame recognition are awarded based on CVSS v3.1 impact criteria.

Critical (P1)

Remote Code Execution & Core Auth

RCE, SQLi leading to full database compromise, complete authentication bypass, or infrastructure takeover.

SQL Injection / NoSQL Injection
Remote Code Execution (RCE)
Privilege Escalation to SuperAdmin

$500 – $1,500 + Hall of Fame

High (P2)

Broken Access Control & Stored XSS

BOLA / IDOR exposing PII of other students, Server-Side Request Forgery (SSRF), or stored cross-site scripting.

IDOR exposing candidate profiles
Stored Cross-Site Scripting (XSS)
Server-Side Request Forgery (SSRF)

$250 – $500 + Hall of Fame

Medium (P3)

Reflected XSS & Session Risks

Reflected XSS, CSRF on state-changing actions, insecure session handling, or misconfigured CORS.

Reflected Cross-Site Scripting
Cross-Site Request Forgery (CSRF)
Insecure Direct Object References (non-PII)

$100 – $250

Low (P4)

Info Leaks & Config Hygiene

Sensitive data exposures in error responses, mixed content, or missing non-critical security headers.

Stack trace exposures
CORS misconfigurations (read-only)
Internal IP leak in headers

$50 – $100 / Swag Kit

Rules of Engagement

Program Scope & Target Assets

Please review the targets below before beginning testing. Attacks causing service denial or accessing user data without authorization violate program rules.

In-Scope Targets

*.careersnova.in, api.careersnova.in, portal.careersnova.in

Out-of-Scope Targets

DoS/DDoS attacks, physical security, social engineering of employees or students, third-party hosted services (e.g. AWS, SendGrid).

Researcher Code of Conduct

Do not access, modify, or delete any real student or partner data.
Stop testing immediately if you encounter private user records and report findings.
Provide reproducible Proof of Concept (PoC) steps with reasonable detail.
Allow up to 30 days for remediation before disclosing findings publicly.

Submit Vulnerability Report

Submissions are encrypted and reviewed by our core SecOps engineering team.