Security Policy
Last Updated: 1st June 2026
1. Scope
This policy covers evenstocks.com, dev.evenstocks.com, and all subdomains. Issues found on third-party services that we use (e.g. payment processors, CDN, analytics) should be reported to those vendors directly.
2. How to Report
Email the contacts listed in our /.well-known/security.txt:
- [email protected] — primary
- [email protected] — fallback / owner
If you need an encrypted channel, ask via the above and we'll exchange a PGP key out-of-band.
3. What We Commit To
- Acknowledgement of receipt within 72 hours.
- Initial triage + severity assessment within 7 days.
- Fix or mitigation plan within 14 days for High / Critical severity.
- Public credit on a future reporters page if you wish (opt-in).
4. What We Ask From You
- Don't access or modify data that isn't yours.
- No DoS / load testing without prior arrangement.
- No social engineering of Evenstocks staff or users.
- Give us reasonable time to fix before public disclosure.
- Stay within Indian and applicable international law.
5. Out of Scope
- Reports relying on outdated browsers, no MFA on a test account, or self-XSS.
- Findings from automated scanners with no manual validation.
- Missing security headers on pages that have no sensitive data.
- Theoretical issues without a working proof-of-concept.
6. No Cash Bounty (Yet)
Evenstocks is currently a free-to-use product run by a small team. We don't have a paid bounty programme today. We can offer credit, a thank-you, and a real conversation with the people building this. If we add a paid bounty later, we'll backfill credit for prior reporters.