>~/security_policy

Security & Vulnerability Disclosure Policy

Security baseline, coordinated disclosure terms, and cryptographic verification standards for Priyansh Khandal's platform and research lab.

[01]

Coordinated Vulnerability Disclosure (CVD)

I believe in transparent, responsible security research. If you discover a security vulnerability in any project, repository, or service hosted on khandal.tech or affiliated subdomains, please report it promptly.

REPORTING GUIDELINES:
  • Provide detailed steps to reproduce the issue, including scripts or HTTP request dumps where applicable.
  • Allow a 90-day coordinated disclosure period before public disclosure to permit mitigation.
  • Do not access, modify, or exfiltrate data belonging to any third parties during testing.
  • Do not execute denial-of-service (DoS) or destructive actions against hosting infrastructure.
[02]

Safe Harbor Guarantee

Security research conducted in good faith and in compliance with this policy is considered authorized. I will not pursue legal action, nor request law enforcement action against researchers who adhere to these guidelines.

Good-Faith Security Research Protected Under Mutual Safe Harbor
[03]

Production Hardening Baseline

The khandal.tech platform operates against a strict 59-point security baseline documented in security.md:

Zero TrackersZero tracking pixels, third-party analytics, or behavioral cookies.
Hardened CSPStrict Content-Security-Policy with frame-ancestors 'none' and HSTS preload.
NixOS IsolationDeterministic build pipelines with declarative package immutability.
Edge ExecutionStatic pre-rendering with zero runtime database vulnerabilities.
[04]

Cryptographic PGP Key & Verification

Encrypt all vulnerability reports, breach telemetry, or confidential binary dumps using the following GPG key:

Key ID: 0x4A8F92E10D3CB8A7Type: 4096R / GPG2
Fingerprint: 4A8F 92E1 0D3C B8A7 E541  9902 C8B1 D403 661F 77AE
Algorithm:   RSA 4096-bit (GPG2)
Expires:     2027-12-31
Identity:    Priyansh Khandal <ipriyansh@outlook.in>
Keyserver:   keys.openpgp.org (search: 0x4A8F92E10D3CB8A7)

Direct reports can be sent to: