Security Policy & Vulnerability Disclosure

1. Security Architecture

At DigiVite.in, we employ security measures to safeguard user profiles, database integrations, guest contact logs, and media assets. Our security framework includes:

• Encrypted Authentication: Passwords are encrypted using robust hashing algorithms (bcrypt) with secure salts. We never store plain-text passwords.
• CSRF Protections: All POST payloads require verification of cryptographically random CSRF tokens to block cross-site script request execution.
• Input Sanitization: Strict filters and database prepared statements defend against SQL injections, cross-site scripting (XSS), and local file inclusions.
• Write-Restricted Assets: Uploaded user assets are isolated inside dedicated, non-executable directories (secure_uploads/).

2. Centralized Error & Audit Logging

Our platform runs a centralized monitoring class (ErrorMonitor). This system automatically captures fatal application errors, unhandled exceptions, and suspicious security events. Captured log payloads include anonymized IP addresses, request URLs, active user IDs, and stack traces, which are written as JSON objects. Alert thresholds prevent notification spam while keeping our operations team aware of system health.

3. Vulnerability Disclosure Policy

We welcome audits and reports from independent security researchers to protect our users. If you discover a vulnerability or security flaw, we ask that you disclose it to us responsibly. Please comply with the following parameters:

A. Rules of Engagement

• Do not perform destructive actions, SQL data extraction, or bulk spam requests.
• Avoid executing distributed denial-of-service (DDoS) tests or automated vulnerability scanners that cause platform slow-downs.
• Do not expose, access, or modify database entries belonging to other users.
• Submit all discoveries to security@digivite.in before sharing the information publicly.

B. Submission Guidelines

When reporting a vulnerability, please provide a clear proof-of-concept description, including steps to reproduce the issue, the impacted endpoints, and recommended patches. We pledge to acknowledge your submission within 48 hours and resolve verified security issues quickly.

4. Incident Response & Indian Regulation

In the event of a verified data breach or cybersecurity incident, we will report the incident to the Indian Computer Emergency Response Team (CERT-In) within the required statutory timelines (under the IT Act, 2000 and CERT-In directions) and notify impacted users as required under the DPDP Act, 2023.