This Policy applies to security vulnerabilities discovered in the following systems and properties operated by Atusha Ventures Private Limited:

Corporate Website: atushaventures.com and all subdomains.

RevenuePilot: revenuepilot.solutions and all subdomains, including the RevenuePilot web application and API.

AdVantageROI: advantageroi.online and all subdomains.

Atlas Daily: atlasdaily.online and all subdomains.

This Policy does not apply to systems, products, or services operated by third parties, even if linked from our websites. If you discover a vulnerability in a third-party system, please report it directly to that third party.

We are interested in receiving reports about the following types of security vulnerabilities:

Authentication and Authorisation Issues: Vulnerabilities that allow unauthorised access to accounts, data, or functionality, including broken authentication, insecure direct object references, and privilege escalation.

Injection Vulnerabilities: SQL injection, command injection, LDAP injection, and similar vulnerabilities that allow attackers to execute unintended commands or access unintended data.

Cross-Site Scripting (XSS): Reflected, stored, and DOM-based XSS vulnerabilities that allow attackers to inject malicious scripts into web pages viewed by other users.

Cross-Site Request Forgery (CSRF): Vulnerabilities that allow attackers to trick authenticated users into performing unintended actions.

Sensitive Data Exposure: Vulnerabilities that expose sensitive data, including personal information, credentials, or confidential business information.

Security Misconfigurations: Significant security misconfigurations that could be exploited by attackers, including exposed administrative interfaces, default credentials, and unnecessary services.

Server-Side Request Forgery (SSRF): Vulnerabilities that allow attackers to make requests from our servers to internal or external systems.

Insecure Deserialisation: Vulnerabilities arising from insecure deserialisation of untrusted data.

The following are outside the scope of this Policy and should not be tested:

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, or any testing that could degrade the availability of our services.

Social engineering attacks targeting our personnel.

Physical security testing.

Automated scanning that generates excessive traffic or load on our systems.

Testing of third-party systems or services, even if linked from our websites.

Vulnerabilities in outdated browsers or operating systems.

Issues that require physical access to a user's device.

Vulnerabilities that have already been publicly disclosed.

Theoretical vulnerabilities without a demonstrated proof of concept.

Missing security headers that do not directly lead to a vulnerability.

Self-XSS vulnerabilities that require the victim to execute the attack themselves.

Clickjacking on pages without sensitive actions.

If you believe you have discovered a security vulnerability within the scope of this Policy, please report it to us by email at: [email protected]

Please include the following information in your report:

(a) A clear description of the vulnerability, including the type of vulnerability and its potential impact.

(b) The URL, endpoint, or system component affected.

(c) Step-by-step instructions to reproduce the vulnerability.

(d) Any proof-of-concept code, screenshots, or other supporting evidence.

(e) Your assessment of the severity of the vulnerability.

(f) Your contact information (name and email address) so that we can follow up with you.

Please encrypt sensitive vulnerability reports using our PGP key if available, or request our PGP key before submitting sensitive information.

In exchange for your responsible disclosure, Atusha Ventures commits to:

Acknowledgement: We will acknowledge receipt of your report within 3 business days.

Communication: We will keep you informed of our progress in investigating and addressing the reported vulnerability. We will provide an initial assessment of the report within 10 business days.

Remediation: We will work diligently to remediate confirmed vulnerabilities in a timely manner, prioritised according to severity.

No Legal Action: We will not pursue legal action against researchers who discover and report security vulnerabilities in good faith and in accordance with this Policy. We consider responsible security research to be a valuable contribution to our security programme.

Credit: With your permission, we will acknowledge your contribution in our security acknowledgements.

In exchange for our commitments, we ask that researchers:

Act in Good Faith: Conduct security research in good faith, with the genuine intention of improving security rather than causing harm.

Avoid Harm: Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence. Do not access, modify, delete, or exfiltrate data beyond what is necessary to demonstrate the vulnerability.

Protect Privacy: Do not access or collect personal data belonging to other users. If you inadvertently access personal data, stop immediately and report it to us.

Avoid Disruption: Do not conduct testing that could disrupt or degrade the availability of our services.

Confidentiality: Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it. We request a minimum of 90 days from the date of our acknowledgement before public disclosure.

Compliance: Conduct all testing in compliance with applicable law.

Atusha Ventures does not currently operate a formal bug bounty programme with monetary rewards. We may, at our discretion, provide non-monetary recognition (such as public acknowledgement) to researchers who report significant vulnerabilities in accordance with this Policy.

We reserve the right to introduce a formal bug bounty programme in the future. Any such programme will be announced on our website.

Atusha Ventures will not pursue civil or criminal legal action against researchers who discover and report security vulnerabilities in good faith and in accordance with this Policy, provided that the researcher:

(a) Does not access, modify, or delete data beyond what is necessary to demonstrate the vulnerability.

(b) Does not conduct testing that disrupts or degrades our services.

(c) Does not engage in social engineering, phishing, or physical security testing.

(d) Reports the vulnerability to us promptly and does not publicly disclose it before we have had a reasonable opportunity to remediate it.

(e) Complies with all applicable laws.

This safe harbour applies only to security research conducted in accordance with this Policy and does not extend to activities that violate applicable law or cause harm to Atusha Ventures, our customers, or third parties.

To report a security vulnerability or for enquiries about this Policy, please contact us at:

Email: [email protected] (Subject: Security Vulnerability Report)

Atusha Ventures Private Limited, KHS-773, Bisrakh, Jalalpur, Bishrakh, Noida, Gautambuddha Nagar, Uttar Pradesh, 201306, India.