Responsible Disclosure Policy

In-Scope: • https://parasym.in and subdomains directly owned and operated by Parasym Syndicate. • Associated public web applications and API endpoints. Out-of-Scope: • Denial of Service (DoS/DDoS) testing, brute-force attacks, or resource exhaustion. • Social engineering, phishing, or physical attacks against Parasym personnel or facilities. • Third-party hosted services (e.g., DNS providers, external CDNs) outside our direct administrative control. • Automated vulnerability scanner reports without verified, non-destructive proof-of-concept reproduction steps.

Parasym Syndicate appreciates good-faith research that protects user privacy and infrastructure stability. If your research adheres to the guidelines set forth in this policy: • Parasym will work constructively with you to understand, verify, and address the reported issue. • We will not consider your activity unauthorized provided it remains strictly within the scope and boundaries defined herein. • We will acknowledge your responsible contribution publicly (if desired) once remediation has been verified. Note: This policy does not operate as a paid commercial bug bounty program, nor does it grant blanket immunity from legal action for activity outside agreed ethical guidelines.

We require researchers conducting responsible testing to adhere to the following principles: • Stop testing immediately if you encounter private user data or sensitive records. Do not view, download, alter, or disclose any user or third-party data. • Execute tests non-destructively; modify or delete only data explicitly created for your own test verification. • Avoid any testing that could degrade service availability, exhaust resources, or interrupt normal operations. • Maintain confidentiality regarding the issue and allow reasonable time (minimum 30 calendar days) for triage and remediation prior to public discussion.

To report a security vulnerability, please email security@parasym.in with the subject line "[Vulnerability Report] Component - Summary", or submit a message via our contact form at https://parasym.in/contact. Please include: • The affected URL or endpoint. • Clear, step-by-step reproduction instructions (including cURL commands or HTTP request payloads). • Technical impact assessment and estimated CVSS severity. • Your contact details for coordinated triage.