Report a vulnerability
If you have found a security problem in one of our systems, we want to hear about it. This page says where to send it and what we ask of you.
How do I report a vulnerability to EK Securities?
Email [email protected] with "Security report" in the subject. Include the affected URL or component, steps to reproduce and what an attacker could do with it. Use your own test accounts, do not degrade the service, and keep the details private until we have fixed it. We confirm receipt and tell you the outcome.
Where to send it
Email [email protected] with "Security report" in the subject. The same contact is published in /.well-known/security.txt.
In scope
- eksecurities.com
- ekrasunya.com and its subdomains
- Products operated by Ek Ra Sunya Inc, including EK ERP (ekerp.cloud) and EK Cloud (ekrasunya.cloud)
Sites we build for clients belong to those clients. Report issues on them to the site owner, or to us and we will pass the report on.
What to include
- The affected URL, endpoint or component
- Steps to reproduce, with the requests you sent
- What an attacker could do with it
- Your name or handle if you would like to be credited
What we ask you not to do
- Do not access, change or delete data that is not yours. Use your own test accounts.
- Do not run denial-of-service, load or spam tests, and do not use automated scanners at volume.
- Do not use social engineering, phishing or physical access against our staff or offices.
- Keep the details private until we have fixed the issue or agreed a date with you.
What happens next
We confirm we have received the report, investigate, and tell you what we found and when it is fixed. If you acted in good faith and within this policy, we treat your research as authorized and will not ask anyone to take action against you for it.
This policy does not offer payment for reports.