01 / SCOPE

What we welcome

Reports about security weaknesses on chethucreations.in that could affect the confidentiality, integrity, or availability of our website.

• Account access or permissions that could expose another customer’s account or order.
• Exposure of private customization photographs, uploaded files, or customer information.
• Injection, unsafe file handling, or script execution with a demonstrable security impact.
• First-party cart, checkout, or order logic that could affect payment or order integrity.

Reporting scope covers this website only. Other domains, subdomains, the Android app, payment providers, hosting, couriers, and social-login services require separate written confirmation and any necessary third-party permission.

02 / RESEARCH RULES

Protect people while you report

• Keep the proof minimal, reproducible, and limited to your own test accounts and data.
• Do not access, copy, change, or delete other people’s data, photographs, or orders.
• No denial-of-service attacks, load testing, brute force, credential stuffing, mass scanning, malware, or persistent access.
• No phishing, social engineering, physical attacks, or contact with customers about a suspected issue.
• Do not create fraudulent orders, complete unauthorized purchases, or manipulate live payments.
• If sensitive information is encountered accidentally, stop, avoid further collection, and report the minimum necessary details privately.

03 / REPORT QUALITY

Show the security impact

A useful report includes the affected URL, clear reproduction steps, expected and actual behavior, and a brief explanation of the risk. Use redacted evidence and keep one root issue per report.

Duplicate or already-known reports, unsupported scanner output, version information alone, missing headers without a demonstrated impact, cosmetic issues, and general product or delivery complaints are not normally eligible for a security reward.

Related symptoms from the same root cause may be treated as one issue. Validation and any reward decision depend on the evidence and actual impact.

04 / RECOGNITION & REWARDS

Clear expectations

There is no published cash bounty schedule. Any reward is discretionary and must be confirmed in writing by Chethu Creations. Submitting a report does not guarantee payment.

Any public acknowledgement requires your consent. Tell us if you prefer to remain anonymous.

05 / COORDINATED DISCLOSURE

Report. Review. Resolve.

1. Send a private reportEmail the issue with minimal, redacted evidence.
2. Help us validate itWe may ask for clarification or a safe reproduction using your own data.
3. Coordinate the next stepsAgree on evidence handling, remediation, and any publication before sharing details publicly.

We review reports, check whether the issue can be reproduced, and coordinate next steps by email. Response and fix times depend on severity and complexity.

Please do not publish exploit details or customer information while an issue is being investigated. This page provides a reporting channel; active testing must stay within the scope separately approved in writing.