Effective Date: January 1, 2026 Last Updated: May 5, 2026

At Appriyo Technologies, security is not an afterthought — it is a core responsibility. We are committed to maintaining the security and integrity of our systems, website, products (Amar Repair, Amar Batch, Amar Card), and the data entrusted to us by our clients.

We genuinely appreciate the efforts of security researchers, developers, and the broader community who help us identify and resolve vulnerabilities responsibly.

This policy applies to:

If you are unsure whether your finding is in scope, report it anyway — we will evaluate it fairly.

If you discover a security vulnerability, please report it privately and responsibly.

📧 security@appriyo.com (If unavailable, use: contact@appriyo.com with subject: "Security Vulnerability Report")

Please provide as much detail as possible:

• Summary — A clear, concise description of the vulnerability
• Affected System — Website, product, API, or repository
• Severity Assessment — Your estimate of the impact (critical, high, medium, low)
• Steps to Reproduce — Detailed, step-by-step instructions to trigger the issue
• Proof of Concept — Screenshots, screen recordings, logs, or code snippets (if applicable)
• Potential Impact — What an attacker could achieve if this were exploited
• Your Contact Info — So we can follow up with you directly

The more detail you provide, the faster we can assess and resolve the issue.

We ask that all security researchers follow these guidelines:

• Report the vulnerability to us privately before any public disclosure
• Give us a reasonable amount of time to investigate and remediate the issue
• Act in good faith — your goal should be improving security, not causing harm

• Publicly disclose the vulnerability until it has been resolved and we have given clearance
• Access, modify, delete, or exfiltrate user or client data
• Disrupt, degrade, or deny service to our systems or users
• Perform social engineering attacks on Appriyo team members
• Attempt physical access to our infrastructure
• Conduct automated scanning that generates significant traffic load without prior permission
• Demand payment or threaten disclosure in exchange for vulnerability details

Researchers who follow this policy will not face legal action from Appriyo for good-faith security research.

We are committed to timely communication:

Timelines may vary depending on the complexity of the issue. We will keep you informed throughout the process.

We assess vulnerabilities using the following framework:

Only the latest production version of our website and products is actively maintained and receives security updates. If you are testing an older version, please verify the issue still exists in the current live environment before reporting.

The following categories are generally considered out of scope and will not result in a security fix:

• Missing security headers with negligible practical impact in our context
• Rate limiting on low-sensitivity, non-authenticated public endpoints
• Self-XSS (requires a user to attack themselves)
• Open redirect that does not facilitate phishing or token theft
• Email spoofing without demonstrated impact (SPF/DMARC informational only)
• Outdated software versions without a demonstrated exploitable vulnerability
• Social engineering or physical attack scenarios
• Vulnerabilities requiring physical device access

We value and respect the work of the security research community. Researchers who responsibly disclose valid, in-scope vulnerabilities will be:

• Acknowledged in our Security Hall of Fame (if they consent to being named)
• Credited in the relevant security advisory or release notes
• Treated with respect and professionalism throughout the process

We currently do not operate a paid bug bounty program. This may change in the future as our products scale.

Appriyo will not pursue legal action against researchers who:

• Discover and report vulnerabilities in good faith
• Follow the guidelines in this policy
• Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
• Do not harm users, systems, or data in the course of their research

Appriyo reserves the right to take legal action against individuals who use security research as a pretext to perform malicious activity, extortion, or unauthorized access.

Appriyo Technologies Khulna, Bangladesh 🕘 Sunday – Thursday, 9:00 AM – 6:00 PM (GMT+6)

Security is a shared responsibility. We thank you for helping us protect our systems and the businesses that trust us.

© 2026 Appriyo Technologies. All rights reserved.