Responsible Disclosure & Security Policy

We take security seriously. If you've found a vulnerability, we want to hear from you.

contact@cruciblealgo.com & support@cruciblealgo.com are actively monitored

Report a Vulnerability

Email us at contact@cruciblealgo.com or support@cruciblealgo.com

PGP Key
0xABCDEF1234567890
View Key
Acknowledgment SLA
≤ 48 hours
Triage SLA
≤ 7 days

Scope

In Scope

  • *.cruciblealgo.com (all subdomains)
  • API endpoints: api.cruciblealgo.com
  • Broker integration adapters (Alpaca, Interactive Brokers, Zerodha, Dhan, Fyers, Angel One, Upstox, Kotak, Shoonya)
  • Authentication & authorization systems
  • Payment processing (Razorpay webhooks)
  • Real-time WebSocket infrastructure
  • Database (Supabase/PostgreSQL) and caching (Redis)

Out of Scope

  • Third-party broker platforms (report to broker directly)
  • Social engineering / phishing against employees
  • Physical security
  • DoS testing without prior approval
  • Vulnerabilities in third-party libraries (report to library maintainer)

Disclosure Process

Step 1: Report SubmittedImmediate

Email contact@cruciblealgo.com or support@cruciblealgo.com with details

Step 2: Acknowledgment≤ 48 hours

We confirm receipt and assign tracking ID

Step 3: Triage & Validation≤ 7 days

We validate, assess CVSS, determine impact

Step 4: Fix & DeployVaries by severity

Develop, test, and deploy fix to production

Step 5: Coordinated DisclosureAfter fix deployed

Public advisory after fix + 14 days

Bug Bounty Rewards (CVSS 4.0)

Maximum per reporter per year: ₹10,00,000. Payment via UPI/Bank transfer within 30 days. TDS deducted per Indian law.

Critical (9.0 - 10.0)
₹1,00,000 - ₹5,00,000
Examples:
RCESQLi → full DB accessBroker credential theftAuth bypass
High (7.0 - 8.9)
₹50,000 - ₹1,00,000
Examples:
Stored XSSIDOR on sensitive dataPrivilege escalationSSRF
Medium (4.0 - 6.9)
₹10,000 - ₹50,000
Examples:
Reflected XSSCSRF on sensitive actionsInfo disclosure
Low (0.1 - 3.9)
₹5,000 - ₹10,000
Examples:
Rate limit bypassMinor info leakMissing security header

Security Controls in Place

Mandatory 2FA

TOTP required for broker connections

Envelope Encryption

AES-256-GCM + AWS/GCP KMS for broker creds

Tiered Rate Limits

10/min critical → 200/min webhooks

Immutable Audit Trail

SHA-256 + S3 WORM (7-year retention)

Hall of Fame

No reports yet — be the first!

Your name could be here

Safe Harbor

We authorize good-faith research and will not pursue legal action if you:

  • Only test against your own accounts or staging.cruciblealgo.com
  • Do not access other users' data, broker credentials, or payment info
  • Do not perform DoS, spam, social engineering, or physical attacks
  • Report findings promptly via contact@cruciblealgo.com or support@cruciblealgo.com
  • Give us time to fix before public disclosure (minimum 14 days after fix)
  • Do not exploit vulnerabilities beyond proving impact

Violations may result in referral to law enforcement.

Compliance

DPDP Act 2023Compliant

Breach notification <72h, user consent, data minimization

SEBI Algo GuidelinesCompliant

Audit trail, kill-switch, static IP, risk limits

PCI DSS (SAQ A)Compliant

Razorpay handles card data; no PAN storage

ISO 27001In Progress

Target: Q1 2027

Policy version-controlled in Git • Reviewed quarterly

Last updated: 2026-08-26

Security Repo Security Center