Security & Responsible Disclosure

We take the safety of our customers' information and payments seriously. If you have found a weakness in this website, we would like to hear about it, and we'll work with you to fix it. This page explains how to tell us and what to expect. The same details are published in machine-readable form at /.well-known/security.txt.

1. How to report

Email care@kalamkarihouse.in with the subject “Security report”. Please include:

• what you found and the page or address where you found it;
• the steps to reproduce it, so we can see it for ourselves;
• what you think someone could do with it;
• how you'd like to be credited, if at all.

Please don't post the details publicly until we've had a fair chance to fix them. Please don't send passwords, card numbers or other customers' personal data — a description of the problem is enough.

2. What's in scope

The website at kalamkarihouse.in: sign-in and accounts, the cart and checkout, order tracking, the contact and password-reset forms, and the staff and admin areas.

Not in scope: the services we rely on — Razorpay (payments), Supabase (database and file storage), Vercel (hosting), Cloudflare (DNS and bot protection), Resend (email) and Google — please report problems in those to the companies that run them. Also out of scope: denial-of-service or volume testing, spam, physical or social-engineering attacks on our people or customers, automated scanner output with no demonstrated impact, and missing hardening settings on their own with no way to exploit them.

3. Ground rules

• Use your own account and your own test orders. Don't look at, change or keep anyone else's data. If you come across personal data by accident, stop and tell us.
• Don't disrupt the site or slow it down for other people.
• Don't try to pay with real cards other than your own, and don't place orders you don't intend to pay for.
• Give us a reasonable time to fix the problem — we ask for 90 days — before you share it with anyone else.

4. What you can expect from us

• A reply within 5 business days to say we've received your report.
• An honest assessment, and updates as we work on it. Serious problems come first.
• A thank-you, and public credit if you want it, once it's fixed.
• No legal action against you for research carried out in good faith under this policy.

We're a small business and don't run a paid bug-bounty programme, so we can't offer a cash reward. If the problem involved customers' personal data, we'll handle it as described in our Privacy Policy.