Responsible Disclosure

1.1 Researcher Protection: We pledge that we will not bring legal action against ethical security researchers who discover and report vulnerabilities in accordance with these guidelines. If an inadvertent third-party legal complaint is initiated, Fortica will confirm in writing that your research was conducted in compliance with our authorized vulnerability disclosure program.

This Policy applies exclusively to the following systems and software owned and operated by Fortica Cyberguard LLP:

• Primary Web Properties: https://forticacyber.com and authorized subdomains (*.forticacyber.com)
• Public API Gateways: Production API services and authentication gateways under Fortica domain control
• Threat Intelligence & Research Feeds: Publicly exposed web applications and client portals operated directly by Fortica

Out-of-Scope Notice: Third-party services, external software dependencies, and hosted infrastructure (e.g., DNS registrars, third-party email providers, GitHub repositories not owned by Fortica) are excluded from this policy and must not be targeted without separate third-party authorization.

• Denial of Service (DoS/DDoS): Causing application degradation, exhaustion of server memory, network flooding, or distributed denial of service.
• Data Destruction or Exfiltration: Downloading, altering, transferring, or deleting user data, server databases, or client engagement records.
• Brute Force & Automated Spam: Automated high-volume credential brute-forcing, fuzzing against contact forms, or email spamming.
• Social Engineering & Phishing: Spear-phishing, voice phishing (vishing), physical intrusion, or impersonation of Fortica personnel.
• Malware Implantation: Installing persistent rootkits, backdoors, or malicious botnet payloads on Fortica servers.

To qualify for safe harbor and formal recognition, security vulnerability reports must be submitted directly to our security engineering team at: secure@forticacyber.com.

Please structure your vulnerability report with the following details:

1. Vulnerability Title & Categorization: (e.g., OWASP Top 10 class, CWE ID, CVSS v3.1 base score estimate).
2. Target Endpoint: Exact URL, HTTP request method, and affected parameter.
3. Step-by-Step Reproduction: Clear, deterministic instructions enabling our triage engineers to reliably reproduce the issue.
4. Sanitized Proof-of-Concept: Screenshots, minimal curl commands, or script snippets demonstrating impact without modifying live system state.
5. Remediation Recommendation: Technical remediation guidance or code patch suggestions.

We respect the time and effort invested by security researchers and commit to rigorous triage timelines:

• 24 Hours: Initial acknowledgment of your submission by an on-call security engineer.
• 72 Hours: Technical severity assessment, CVSS scoring confirmation, and impact determination.
• 14-Day Cadence: Status updates on development progress and patch deployment.
• 90 Days: Standard coordinated remediation window. The researcher agrees to refrain from sharing, publishing, or discussing the vulnerability with any third party until Fortica has deployed the patch and issued confirmation.

To celebrate valuable contributions, ethical researchers who submit verified, novel security vulnerabilities will receive:

• Hall of Fame Credit: Permanent attribution on our official Security Research Hall of Fame (with full name, handle, and personal research link).
• Digital Certificate of Appreciation: A cryptographically signed attestation letter from Fortica Cyberguard leadership.
• Exclusive Research Swag: Limited-edition Fortica Threat Lab engineering apparel and technical tokens.

Fortica reserves the right to modify this Policy at any time without prior notice. By participating in research against Fortica systems, you affirm acceptance of this Policy and agree that any dispute arising hereunder shall be subject to the exclusive jurisdiction of the competent courts in Ahmedabad, Gujarat, India.