Qyntraix VDP
Vulnerability Disclosure Program • Qyntraix Global Cyber Defense
Official Coordinated Disclosure Portal

Qyntraix Vulnerability Disclosure Program

Responsible Security Research & Recognition Program

At Qyntraix Global Cyber Defense, security and trust are foundational. We welcome responsible disclosures from ethical security researchers and bug bounty hunters worldwide to help us protect our infrastructure and community.

Reward Policy & Recognition Notice

Qyntraix does not currently offer guaranteed monetary bounties (Cash Bounty Status: MONETARY_REWARD_ENABLED = false). Valid, novel, and verified responsible disclosures are rewarded with Hall of Fame recognition, official Letters of Appreciation, and optional public social media shout-outs for exceptional findings.

Strict NO-DDoS / NO-DoS Rule

NO DDoS • NO DoS • NO Resource Exhaustion • NO Traffic Flooding • NO Stress Testing • NO Volumetric Crawling. Researchers must never degrade availability, responsiveness, or service continuity for legitimate users. Any denial-of-service attempt immediately voids Safe Harbor protections.

Good-Faith Safe Harbor

Qyntraix Global Cyber Defense will not pursue legal action or report ethical security researchers to law enforcement, provided that researchers act in good faith, strictly comply with this Vulnerability Disclosure Policy, do not access or tamper with customer data, refrain from privacy violations, and avoid any disruption of service availability.

✓ Authorized Testing Good-faith research within authorized scope is treated as explicitly permitted.
✓ Safe Harbor Legal Protection We will not initiate legal proceedings against researchers adhering to this policy.
✓ Non-Destructive Proof Stop immediately upon verifying vulnerability existence. Do not extract bulk data.

In-Scope Assets

The following hostnames are explicitly authorized for responsible research:

  • https://api.qyntraix.in — Primary API Gateway
  • https://bughunterai.qyntraix.in — BugHunter AI Platform
  • https://bugbounty.qyntraix.in — VDP Portal

Strictly Out-of-Scope Assets

The following assets are strictly excluded from research:

  • Cloudflare & edge worker networks
  • Render & hosting infrastructure
  • Razorpay payment processing endpoints
  • Customer systems, DNS & email providers

Frequently Asked Questions

What is the Qyntraix Vulnerability Disclosure Program?

The Qyntraix VDP is our official coordinated vulnerability disclosure channel. It provides security researchers with a safe-harbor protected framework to report vulnerabilities affecting in-scope Qyntraix infrastructure.

Who can report a vulnerability?

Any independent security researcher, ethical hacker, customer, or member of the public acting in good faith who adheres to our policy may submit a report.

What systems are in scope?

Authorized in-scope hostnames are explicitly limited to: https://api.qyntraix.in, https://bughunterai.qyntraix.in, and https://bugbounty.qyntraix.in. All others are strictly out of scope.

What testing activities are prohibited?

Strictly prohibited: Denial of Service (DDoS/DoS) of any kind, traffic flooding, volumetric crawling, brute force, credential stuffing, phishing, and accessing or modifying user data.

Does Qyntraix provide safe harbor?

Yes. Qyntraix will not pursue legal action against ethical researchers acting in good faith who follow this policy and avoid disrupting services.

How should researchers submit?

Researchers sign in with single sign-on on https://bugbounty.qyntraix.in/ and submit findings via the encrypted disclosure form with structured reproduction steps.

What information should reports contain?

Affected endpoint URL, vulnerability severity and category (OWASP/CWE), step-by-step reproduction instructions, proof-of-concept, and remediation suggestions.

How does Qyntraix handle reports?

Submissions are encrypted in transit, assigned a unique reference ID (QYN-VDP-*), and triaged confidentially by the Qyntraix security engineering team.

Are vulnerability reports public?

No. Report submissions and technical evidence are strictly confidential. Validated researchers who opt in are recognized on our Hall of Fame.

Is this the same as BugHunter AI?

No. BugHunter AI (https://bughunterai.qyntraix.in/) is an offensive methodology product. Qyntraix VDP (https://bugbounty.qyntraix.in/) is the coordinated disclosure intake portal.