Reporting a security vulnerability

Saralya builds lending software that NBFCs use to serve their borrowers, so the data in our systems belongs to real people. If you believe you have found a way to reach data or functions you should not, we want to hear from you, and we will work with you to fix it.

1. What is in scope

• This website, saralya.in, including Saralya AI and the LMS Explorer.
• Saralya services on subdomains of saralya.in, such as cj-api.saralya.in, sap.saralya.in and bo.saralya.in.
• Saralya's mobile apps, including the borrower apps we build for lenders and the BO Connect field app.

Services run by our lending partners, their websites, and third-party providers (for example payment gateways, KYC or credit-bureau vendors) are out of scope. Report issues in those to the organisation that runs them.

2. How to report

Send an email to security@saralya.in with:

• what you found, and where (the URL, app screen or API endpoint);
• the steps to reproduce it, and what an attacker could do with it;
• any proof of concept, screenshots or request/response samples, with personal data removed;
• how we can reach you, and whether you would like to be credited.

Please do not report through social media or public issue trackers, and do not share the details with anyone else until we have fixed the problem.

3. What we commit to

• We acknowledge your report within 3 business days.
• We tell you our assessment, and our plan to fix it, within 10 business days.
• We keep you informed until it is fixed, and we tell you when it is.
• With your permission, we credit you once the fix is live.

Where a report shows that personal data may have been exposed, we handle it as a security incident: we inform the affected lenders and report to CERT-In and other authorities within the timelines Indian law requires.

4. Rules for good-faith research

To stay within this policy:

• Do not access, copy, change or delete other people's data. Use only accounts and data that are yours. If you come across a borrower's or a lender's personal data, stop at once, do not keep it, and tell us what you saw.
• Do the least needed to demonstrate the problem. Do not use a finding to move further into our systems.
• Do not run denial-of-service tests, flood forms, OTP or SMS endpoints, or run high-volume automated scans.
• Do not use social engineering, phishing or physical attacks against Saralya, our lenders or their borrowers.
• Do not trigger real financial transactions, credit-bureau enquiries or messages to real people.
• Give us reasonable time to fix the problem before you disclose it publicly. We ask for 90 days, and will agree a date with you.

5. Safe harbour

If you follow this policy, we consider your research authorised. We will not bring legal action against you or report you to law enforcement for it, and if a third party takes action against you for research done under this policy, we will make it known that you acted with our authorisation. If you are unsure whether something is allowed, ask us first at security@saralya.in.

6. Reports we usually do not act on

These are rarely a risk on their own. Report them if you can show a real impact:

• missing security headers or cookie flags with no demonstrated exploit;
• clickjacking on pages with no sensitive action;
• self-XSS, or issues that need a compromised device or browser;
• software version disclosure, or banners, with no known vulnerability;
• rate limits on endpoints that do nothing sensitive;
• email configuration reports (SPF, DKIM, DMARC) with no demonstrated spoofing;
• results from automated scanners that have not been verified.

7. Rewards

We do not currently run a paid bug bounty. We are grateful for every report, and we are happy to credit researchers who help us protect the people who use our lenders' services.

8. Machine-readable contact

Our contact details are also published at /.well-known/security.txt, following RFC 9116.