Security Practices and Responsible Vulnerability Disclosure

We work to protect accounts, academic and CV information using authenticated access, authorization checks, service secrets, file validation, malware/invalid-file safeguards as available, user scoping, operational limits, controlled external-service requests and appropriately restricted logs. Our deployed controls are regularly reviewed and may change. We do not claim guaranteed security, a specific certification, penetration-test outcome or encryption standard unless independently verified.

If you discover a potential vulnerability affecting AI Tathastu, contact [VERIFY: security@ domain or official address] with a high-level description, affected page/feature and safe reproduction details. Do not exploit the issue, access other users' accounts, exfiltrate personal data, disrupt services, attack third parties or publicly disclose private personal data. Ask for authorization before conducting active security tests. We will acknowledge reports using our published process Awaiting Verification: response process.

We investigate suspected breaches, contain the issue, preserve relevant evidence and assess notification obligations, including applicable CERT-In reporting and DPDP obligations on their commencement timetable. We do not promise to detect every incident immediately. Where legally required, we will notify affected people and authorities according to the governing law.

Use strong credentials, sign out on shared devices, review authorized connections and promptly report suspicious activity. Never send a password or API key to support.