Security & Responsible Disclosure

As a web and software development agency, security is part of how we build. If you believe you have found a genuine vulnerability affecting a system Purnavix operates, we want to know about it so we can address it.

If you discover a suspected security vulnerability, please report it to us at contact@purnavix.com. Please include enough detail for us to understand and reproduce the issue.

A useful report typically includes:

• A clear description of the vulnerability and its potential impact.
• The URL, endpoint, or system affected.
• Steps to reproduce the issue.
• Any supporting evidence, such as screenshots or request/response details (without including real customer data).
• Your contact details, so we can follow up with you.

We ask that you give us a reasonable opportunity to investigate and address a reported issue before disclosing it publicly, and that you act in good faith, avoiding any action that could harm our systems, our clients, or their data.

When investigating a suspected vulnerability, please do not:

• Access, modify, or delete data that does not belong to you.
• Attempt to access another user's or client's account or data.
• Disrupt or degrade the availability of our services, including through denial-of-service testing.
• Perform destructive testing against production systems.
• Attempt to socially engineer our staff, contractors, or clients.
• Publicly disclose a suspected vulnerability before we have had a reasonable opportunity to address it.

We will acknowledge a good-faith report and work to understand and address it. Purnavix does not currently operate a formal bug bounty program, and we are not able to offer monetary rewards for reports at this time — we do, however, genuinely appreciate responsible disclosure and will treat every legitimate report seriously.

This process is intended for suspected vulnerabilities affecting systems that Purnavix directly operates, such as purnavix.com. For a vulnerability affecting a client's own system that we have built, please also let us know so we can advise you on the appropriate next step.

Report a suspected vulnerability to contact@purnavix.com.