SECURITY & DISCLOSURE

1. Reporting a vulnerability

SKOPAQ AI PRIVATE LIMITED takes security reports seriously, including for a marketing site. Thank you for taking the time to tell us about a problem rather than exploiting it.

Report privately by email to solutions@skopaq.com, with [SECURITY] at the start of the subject line. Please give us a reasonable window to fix the problem before publishing. Do not open a public issue, discussion or pull request for a security problem — a public report tells attackers before it tells us.

If you found a credential or key that appears to belong to SKOPAQ AI — in this repository, its git history, or the deployed bundle — treat it as urgent and say so in the subject line.

2. What to include

The more of this we get, the faster the fix:

• The URL or page, and which part of the site (section, form, overlay).
• Browser and version, operating system, and viewport if it is layout-dependent.
• Step-by-step reproduction, starting from a fresh page load.
• A proof of concept — a request, a payload, a short recording.
• The impact you believe it has, and any prerequisites.
• Whether you have shared this with anyone else, and any disclosure deadline you intend to hold us to.

3. In scope

• This site, as deployed at skopaq.com.
• Anything the built client bundle exposes — leaked secrets, injectable markup, unsafe handling of URL or form input, dependency vulnerabilities with a demonstrated path to exploitation here.
• Supply-chain issues in the committed dependency tree.

4. Out of scope

• Findings from an automated scanner with no working proof of concept, and "outdated dependency" reports with no exploitable path in this app.
• Missing security headers, TLS configuration, or DNS/CDN settings on infrastructure we do not control — though we are happy to hear about them.
• Volumetric denial of service, load testing, and spamming the contact form.
• Self-XSS, and issues requiring a physically compromised device, a malicious browser extension, or an already root-compromised OS.
• Clickjacking or missing anti-CSRF on pages with no authentication and no state-changing action — this site has no login and no user accounts.
• Social engineering of SKOPAQ AI staff or clients.
• skopaq.ai. That domain hosts a separate, already-live product which is not built from this site. Reports about it are welcome at the same address, but they are not in scope for this policy.

5. Safe harbour

We will not pursue or support legal action against anyone who, in good faith, reports promptly and privately through the channel above, limits testing to what is necessary to demonstrate the issue, does not access, modify, exfiltrate or destroy data belonging to SKOPAQ AI, its clients or site visitors, does not degrade the service for others, and gives us reasonable time to fix the issue before disclosing it publicly.

We do not currently run a paid bug bounty. Reports are still welcome, and credit is offered gladly.

6. Machine-readable policy

The same reporting address is published at /.well-known/security.txt, in the format defined by RFC 9116, together with the preferred language and the canonical location of that file.

7. Attestations and certifications

SKOPAQ AI PRIVATE LIMITED holds no SOC 2 attestation and makes no claim of HIPAA certification or compliance. Where an engagement involves clinical or otherwise regulated data, the handling, retention and anonymisation requirements are agreed in writing before any data is processed.