Responsible Vulnerability Disclosure Policy

OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we", "us", or "our") values the work of independent security researchers and the broader security community in helping keep OrbitSub and our users safe. This Responsible Vulnerability Disclosure Policy ("Policy") sets out the scope, rules of engagement, reporting channel, response timelines, and legal safe-harbour protections for good-faith security research.

1. Scope of Covered Systems

1.1 In-Scope Targets

The following assets owned and operated by OrbitSub are in scope for good-faith vulnerability research:

• The primary web application at https://orbitsub.com and its direct first-party subdomains;
• The OrbitSub REST API (/api/*) and real-time collaboration WebSocket endpoints; and
• Document export, citation resolution, and authentication flows hosted on our first-party infrastructure.

1.2 Out-of-Scope Targets & Excluded Findings

The following systems, attack methods, and low-impact findings are strictly out of scope:

1. Third-Party Infrastructure & Sub-Processors: Services operated by PayPal, Google OAuth, Cloudflare, Vercel, Resend, Sentry, our cloud hosting/database providers, or third-party AI model and search providers (please report vulnerabilities in those services directly to their respective security programmes);
2. Availability & Volumetric Attacks: Distributed Denial of Service (DDoS), application-layer resource exhaustion, automated spam flooding of forms, feedback boards, or Live Rooms;
3. Social Engineering & Physical Security: Phishing, vishing, smishing, or social engineering directed at OrbitSub personnel or users, or physical intrusion attempts;
4. Unverified Scanner Output: Raw output from automated vulnerability scanners without a working, reproducible proof-of-concept demonstrating real security impact;
5. Non-Exploitable Configuration Observations:
   • Missing or permissive HTTP headers, cookie flags on non-sensitive cookies, or SSL/TLS cipher grading that do not lead to a demonstrable exploit;
   • SPF, DKIM, or DMARC configuration suggestions without demonstrated email spoofing;
   • Rate-limiting thresholds on non-sensitive public read endpoints;
   • Presence of public documentation, /status health telemetry, or software version banners;
   • Self-XSS (requiring a user to paste malicious code into their own browser console) or CSRF on unauthenticated/non-state-changing forms;
   • Clickjacking on static pages that perform no sensitive state-changing actions;
   • Enumeration of public usernames, public profile handles, or public research slugs by design.

2. Rules of Engagement for Good-Faith Research

To qualify for safe harbour under Section 5 of this Policy, you must adhere to all of the following rules when conducting security research:

1. Test Only Against Your Own Accounts: Perform all testing exclusively using test Accounts that you registered yourself or Accounts for which you have the explicit written consent of the owner.
2. Zero Harm to Other Users' Data: Never access, read, modify, corrupt, download, or delete manuscripts, Reference Libraries, personal data, or private Live Rooms belonging to any other user.
3. Stop & Report Upon Encountering Non-Public Data: If a vulnerability inadvertently exposes non-public personal data, credentials, or user manuscripts, stop testing immediately, capture only the minimal technical metadata necessary to prove the existence of the flaw, delete any inadvertently retrieved data from your systems, and report the issue to us right away.
4. Do Not Disrupt Service Availability: Do not execute automated brute-force attacks, high-concurrency fuzzing, or payload floods that degrade platform performance for other researchers.
5. No Extortion or Commercial Exploitation: Do not demand payment as a precondition for disclosing a vulnerability, and never sell, weaponise, or share exploit details with third parties.
6. Coordinated Confidentiality (90-Day Disclosure Window): Keep all details of the discovered vulnerability confidential until we have deployed a fix and confirmed remediation to you, or until 90 calendar days have elapsed from your complete report, whichever occurs first (unless mutually extended in writing).
7. Comply with Applicable Law: Conduct your research in good faith and in compliance with applicable laws.

3. How to Submit a Vulnerability Report

Please send your vulnerability report by email to team@orbitsub.com with the subject line Security Vulnerability Report. Please do not post vulnerability details on public forums, GitHub issues, social media, or community boards on OrbitSub.

To help us triage and reproduce your finding rapidly, please include:

1. Summary & Vulnerability Class: A clear description of the vulnerability (e.g., IDOR, stored XSS, authentication bypass, privilege escalation, SSRF) and the affected endpoint or component;
2. Step-by-Step Reproduction Instructions: Complete, deterministic steps, HTTP requests/responses, curl commands, or a short screen recording sufficient for our engineering team to reproduce the issue on a test account;
3. Security Impact Assessment: What an attacker could realistically achieve and which user data or system boundaries are affected; and
4. Contact & Attribution Preferences: How we can reach you for follow-up questions and whether you would like public acknowledgement once resolved.

4. Our Response & Remediation Commitments

When you submit a report in accordance with this Policy, we commit to the following target timelines:

5. Legal Safe Harbour

If you conduct security research and report a vulnerability in good faith and in full compliance with this Policy:

1. Authorised Conduct: OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India considers your security testing to be authorised with respect to the Computer Misuse / Information Technology provisions applicable to our first-party systems (including Section 43 and Section 66 of the Indian Information Technology Act, 2000 and analogous anti-hacking statutes in other jurisdictions);
2. No Legal Action by Us: We will not initiate civil litigation or refer your good-faith research to law enforcement; and
3. Intermediary Confirmation: If a third party initiates legal action against you solely for activities conducted in strict compliance with this Policy, we will take steps to make known to the relevant court or authority that your activities were conducted pursuant to and authorised by this Responsible Disclosure Policy.

Statutory Note: This safe harbour applies only to claims within the legal authority of OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India and does not bind independent third-party service providers or government regulators. Please note that where a vulnerability has resulted in an actual security incident or unauthorized exposure of data, we may be legally required to report the technical incident to the Indian Computer Emergency Response Team (CERT-In).

6. Recognition & Rewards

OrbitSub is an independently operated platform and does not currently run a paid cash bug bounty programme. However, for valid, original, first-reported vulnerabilities of Medium, High, or Critical severity, we are pleased to offer:

• Written confirmation and public recognition (with your permission) in our security acknowledgements; and
• Discretionary complimentary upgrades to our Pro subscription tier or other tokens of appreciation.

All recognition and discretionary rewards are awarded at our sole discretion.

This Policy is effective from 1 October 2026 and was last updated on 25 October 2026.