Responsible Vulnerability Disclosure

1. Program Philosophy & Safe Harbor

HiqMobi values the contributions of the independent security research community in helping us keep our platform, creators, and advertiser data secure. We provide a safe harbor framework for researchers who discover and report potential vulnerabilities in good faith.

We pledge not to initiate legal action against researchers who comply with the guidelines outlined below.

2. Scope of Testing

In Scope:

• Public web properties under *.share360.in
• Public mobile API endpoints under api.share360.in (or designated server hosts)
• Share360 Android application distributed through the official Google Play Store

Strictly Out of Scope:

• Denial of Service (DoS/DDoS) attacks against servers, gateways, or networks
• Social engineering, phishing, or physical attacks against HiqMobi employees, contractors, or office premises
• Accessing, altering, or exfiltrating user data that does not belong to your test account
• Spamming contact forms, SMS gateways, or third-party postback providers

3. Responsible Testing Guidelines

• Promptly report any suspected vulnerability to our security desk before publicly sharing or disclosing it.
• Provide a reasonable timeline (minimum 60 business days) for remediation before public disclosure.
• Use test accounts created specifically for security research purposes.
• If sensitive user data or payment information is inadvertently accessed, cease testing immediately and purge local copies.

4. How to Submit a Vulnerability Report

Please email your report to our security team with the subject line [Vulnerability Report] Component - Summary:

Include: clear step-by-step reproduction instructions, HTTP request/response samples, Proof of Concept (PoC) scripts or screenshots, and an assessment of potential impact.