Responsible Disclosure

Our approach to security

CreditBucket Technologies Private Limited is ISO/IEC 27001:2022 certified for Information Security Management. We take the security of our platform, our partners' data, and our borrowers' information seriously, and welcome responsible reporting of genuine security concerns from the security research community.

Scope

This policy applies to security vulnerabilities affecting CreditBucket's public-facing digital properties, including this website and associated CreditBucket and Samriddh Kendra digital platforms. It does not extend to social engineering of our staff or partners, physical security of our offices or Samriddh Kendra outlets, or third-party services we integrate with but do not control.

Reporting a vulnerability

If you believe you've identified a genuine security vulnerability, please report it to info@creditbucket.in with the subject line "Security Disclosure," including:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any relevant screenshots, logs, or proof-of-concept detail

What we ask

• Do not access, modify, or delete data that does not belong to you.
• Do not run automated scanning tools that could degrade service for our users or partners.
• Give us reasonable time to investigate and remediate before any public disclosure.
• Do not attempt to exploit a vulnerability beyond what's needed to demonstrate it exists.

What to expect from us

We will acknowledge genuine reports, investigate promptly, and keep you informed of our progress. As a growing company, we do not currently operate a paid bug bounty program, but we're genuinely grateful for responsible disclosure and will credit researchers who report valid issues, where they'd like to be credited.