If you believe you have found a security vulnerability in Finocket, we want to hear from you before you tell anyone else. Write to support@dmstfy.com with enough detail for us to reproduce it.
What to include
- What you did, step by step, and what happened.
- The URL, screen or API endpoint involved.
- Roughly when you tested, so we can find it in our logs.
- Anything that would help us tell a real issue from a false positive.
What we commit to
- We will acknowledge your report.
- We will tell you whether we consider it a vulnerability, and why.
- We will keep you updated while we fix it, and tell you when it is fixed.
- We will credit you if you would like to be credited, and not if you would rather not be.
We do not currently run a paid bug-bounty programme. We would rather say that plainly than imply a reward we do not offer.
Please do not
- Access, modify or delete data belonging to anyone but yourself. If you reach someone else's data, stop and tell us what you saw — do not collect more of it to prove the point.
- Run denial-of-service, load or spam tests against our systems, or anything that degrades service for real businesses using Finocket.
- Use social engineering, phishing or physical intrusion against our staff.
- Disclose the issue publicly before we have had a reasonable chance to fix it.
Safe harbour
If you follow this policy in good faith, we will treat your research as authorised, will not pursue legal action over it, and will work with you. If a third party brings action against you for research that followed this policy, we will make that clear.
Where our data lives
Finocket runs on infrastructure in India. Customer data — books, GST records and KYC — is held in the Mumbai region and is not replicated outside India.
Machine-readable contact
The same contact details are published at /.well-known/security.txt in the format described by RFC 9116.
For privacy requests rather than security reports, see our Privacy Policy, or contact grievance@dmstfy.com.