Report Security Issues

1. Our Security Commitment

Sukoonsaathi aims to maintain reasonable security practices for its website, systems, customer accounts, appointment services, payment integrations, and other technology used to deliver our services.

We appreciate responsible security research. Reporting a genuine vulnerability helps us protect customers, improve our systems, and reduce the risk of harm.

2. What to Report

Please report issues that could affect the confidentiality, integrity, or availability of Sukoonsaathi systems, customer information, accounts, or services. Examples may include:

• Authentication or authorization weaknesses.
• Unauthorized access to another customer's information or account.
• Security vulnerabilities in the Sukoonsaathi website or APIs.
• Unintended exposure of sensitive information.
• Significant security misconfigurations.
• Cross-site scripting, injection, access-control, or similar application vulnerabilities.
• Security issues that could materially affect customer privacy or service integrity.

3. How to Report

At this time, Sukoonsaathi accepts security reports by email. Please use the subject line “Security Issue Report” so the message can be identified and routed appropriately.

4. Useful Report Details

A helpful security report normally includes:

1. A clear description of the suspected vulnerability.
2. The affected website URL, page, API endpoint, or feature.
3. Steps to reproduce the issue in a safe and controlled manner.
4. The expected behavior and the actual behavior observed.
5. The potential security or privacy impact.
6. Relevant screenshots, request/response examples, or proof-of-concept information where safe to provide.
7. Your preferred contact information if we need clarification or follow-up.

5. Responsible Testing

Security research should be performed responsibly and with the minimum level of access or activity needed to demonstrate the issue.

If you discover a vulnerability, please stop testing once you have enough evidence to demonstrate the issue. Avoid accessing, modifying, downloading, or retaining customer data that is not your own.

If testing could affect availability or customer data, contact us before performing further testing whenever reasonably possible.

6. Activities to Avoid

Please do not perform security testing that could cause harm to customers, systems, or third parties. In particular, avoid:

• Denial-of-service or resource-exhaustion attacks.
• Spam, phishing, social engineering, or attacks against Sukoonsaathi staff or customers.
• Accessing, changing, deleting, or downloading data belonging to other customers.
• Using compromised accounts or credentials beyond what is necessary to demonstrate the issue.
• Installing malware or attempting to establish persistent access.
• Physical attacks against people, offices, devices, or infrastructure.
• Testing third-party systems where Sukoonsaathi is not the owner or operator.

7. What We Will Do

When we receive a security report, we will make reasonable efforts to review the information and determine whether the reported issue affects Sukoonsaathi systems or services.

Depending on the nature of the issue, we may investigate, reproduce, remediate, monitor, or otherwise address the reported vulnerability. We may contact the reporter if additional information is required.

We may also determine that a report does not represent a security vulnerability, is outside our control, or requires action by a third-party provider.

8. Response & Resolution

We aim to acknowledge meaningful security reports within a reasonable period, but response and remediation timelines may vary according to severity, complexity, available information, dependencies, and potential impact.

We may not be able to provide detailed information about internal security controls, investigations, fixes, affected systems, or customer information.

If an issue affects customer security or privacy, we may take additional steps that we consider appropriate under the circumstances and applicable law.

9. Privacy of Reports

Please avoid including unnecessary personal information in a security report. Information provided to us may be used to investigate and respond to the reported issue.

We may retain security reports and related communications as reasonably necessary for security, compliance, record-keeping, incident management, and improvement of our systems.

Our handling of personal information is also subject to the Sukoonsaathi Privacy Policy.

10. Bug Bounty & Rewards

Sukoonsaathi does not currently operate a formal public bug bounty program and does not guarantee monetary compensation, rewards, or recognition for vulnerability reports.

We may choose to recognize or thank researchers for responsible reports at our discretion, subject to any applicable confidentiality or security considerations.

11. Account Issues

If you are simply unable to log in, forgot your password, or believe you have lost access to your own Sukoonsaathi account, please use the normal account-support process or contact us.

If you believe the account-access problem is caused by a security vulnerability or unauthorized access, clearly identify it as a security issue in your report.

12. Contact

For security or privacy-related vulnerabilities affecting Sukoonsaathi, please contact: