Responsible Disclosure Policy

OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we" or "us") welcomes reports from security researchers who help keep the Service and its users safe. This Policy explains how to report a vulnerability and the rules for doing so.

1. Scope

In scope: orbitsub.com, its subdomains, and the OrbitSub web application and API.

Out of scope:

1. services operated by third parties, including PayPal, Google, Cloudflare, Vercel and our other providers, which have their own programmes;
2. denial-of-service testing, spam, and social engineering of our users or of us;
3. physical attacks;
4. reports from automated scanners without a demonstrated, exploitable impact;
5. missing security headers, best-practice recommendations or version disclosures without a demonstrated impact;
6. vulnerabilities that require a compromised device, or attacks that only affect the researcher's own account.

2. Rules for good-faith research

When researching vulnerabilities, you must:

1. use only accounts you own or have explicit permission to use;
2. access no more data than needed to demonstrate the issue, and never modify or delete data belonging to others;
3. stop and report immediately if you encounter personal data or other users' Content, and do not keep, copy or share it;
4. not degrade, disrupt or interrupt the Service for others;
5. not use the vulnerability for any purpose other than verifying and reporting it;
6. keep the vulnerability confidential until we have fixed it, or until 90 days after your report, whichever is sooner, unless we agree otherwise;
7. comply with all applicable laws.

3. How to report

Email team@orbitsub.com with the subject line "Security", including a description of the vulnerability, the steps to reproduce it, its potential impact, and how we can contact you. Please do not report vulnerabilities through public channels.

4. What we commit to

1. We will acknowledge your report within 72 hours.
2. We will investigate, keep you informed of our progress, and tell you when the issue is fixed.
3. We will give you credit for the discovery if you wish, once the issue is fixed.

5. Safe harbour

If you act in good faith and follow this Policy, we will consider your research authorised, we will not pursue legal action against you for it, and if a third party brings legal action against you for research that complied with this Policy, we will make it known that your research was authorised. This does not bind third parties or authorities, and it does not authorise any activity outside this Policy. Please note that we may be required by law to report certain security incidents to CERT-In.

6. Rewards

OrbitSub is an early-stage, independently run business and does not currently operate a paid bug bounty programme. We may choose to thank valuable reports publicly or with a token of appreciation, but no monetary reward should be assumed.

This Policy is effective from 1 October 2026.