Legal

Responsible Vulnerability Disclosure Policy

Effective Date: 11 May 2026 · Last Updated: 2 July 2026

At Luckshri, the security of our customers' data is a top priority. We believe that responsible vulnerability disclosure is a key part of modern security and welcome reports from the security research community. We are committed to working with researchers in good faith.

1. Reporting a Vulnerability

If you believe you have found a security vulnerability in our services, please report it to us by emailing [email protected] with the subject line "Security Vulnerability Report."

Please include as much detail as possible:

The URL or location of the vulnerability.
A description of the issue and its potential impact.
Steps to reproduce the issue.
Any supporting material (screenshots, request/response samples).

2. Our Commitment

If you follow this policy and report a vulnerability to us, we commit to:

Acknowledging receipt of your report in a timely manner.
Investigating and validating the reported issue.
Providing an estimated timeline for resolution.
Keeping you informed as we investigate and resolve the issue.

Safe Harbor

If you act in good faith, avoid accessing personal data belonging to others, do not disrupt our services, and report vulnerabilities responsibly under this policy, we will not initiate legal proceedings against you for your research activities. This assurance applies only to activities conducted in accordance with this policy and does not extend to malicious activity, privacy violations, service disruption, or actions outside the defined scope below.

3. Guidelines for Researchers

To help us protect our customers, we ask that you:

Do not access, download, modify, or retain personal information belonging to other users.
Do not perform any actions that could disrupt our services (e.g., DoS/DDoS).
Do not use automated scanners in a way that causes excessive load on our systems.
Give us a reasonable amount of time to fix the issue before disclosing it publicly.

4. Out of Scope

The following are generally outside the scope of this programme:

Missing security headers with no demonstrated security impact.
Reports based solely on automated scanner output without demonstrated exploitability.
Clickjacking on pages that do not involve sensitive actions.
Issues requiring physical access to a user's device.
Self-XSS vulnerabilities (where the attacker is also the victim).
Social engineering attacks targeting Luckshri staff.
Third-party services (payment processors, cloud infrastructure, logistics providers) — please report these directly to the respective provider.

5. Scope

This policy applies to official Luckshri websites and subdomains that are publicly operated by us, unless expressly excluded. This includes:

luckshri.com
Official Luckshri subdomains operated by us
Our official mobile applications

Third-party services integrated into our platform — including payment gateways, logistics providers, and cloud infrastructure — are not in scope. Please report vulnerabilities in those services directly to their respective providers.

6. Contact

For security-related enquiries under this policy:

Luckshri Security

Email: [email protected]

Please use the subject line "Security Vulnerability Report" for vulnerability disclosures.

← Back to Home

Since 1919