Last updated: 16 September 2026
Found a potential security issue on ayushworks.xyz? Please report it privately to [email protected]. Use the subject Security report — ayushworks.xyz.
This is the security reporting policy for Ayush Basak’s personal website. For technical articles, visit Security Engineering. For information about personal data, read the Privacy Policy.
What this policy covers #
Reports should concern this portfolio at www.ayushworks.xyz or ayushworks.xyz, including its public pages and website-owned endpoints. Examples include script injection, unintended exposure of private information, and access-control failures.
Linked products, GitHub, Vercel’s own services, YouTube, and external AI providers are not covered by this policy. Saleslyt and Myotrek are separate products; their presence in the portfolio does not authorize testing them. Report issues in third-party systems through their own security channels.
What to include #
- The affected URL and a short description of the issue.
- Minimal steps to reproduce it, using your own data where possible.
- The expected behavior, observed behavior, and potential impact.
- The time observed, including timezone, and relevant browser or client details.
- Redacted screenshots or request examples if they help explain the issue.
Do not send live credentials, session tokens, other people’s personal information, or large data dumps. If evidence is sensitive, describe it first and ask how to share it safely. Ordinary email is not an end-to-end encrypted reporting channel; no public encryption key is currently provided here.
Safe reporting boundaries #
This page invites reports; it does not grant blanket authorization to scan, exploit, or access systems. Ask for written permission before active testing beyond normal public browsing. If you encounter a vulnerability accidentally, stop once you have enough information to describe it.
- Do not access, download, modify, or delete another person’s data.
- Do not run denial-of-service tests, high-volume scans, credential attacks, or spam.
- Do not use phishing, social engineering, malware, persistence, or lateral movement.
- Do not bypass controls on third-party infrastructure or use a finding to reach other systems.
- If private information becomes visible, stop immediately, avoid retaining it, and report the location privately.
Follow applicable law and the Terms and Conditions. This policy cannot grant permission on behalf of another service or provide immunity from third-party action.
After you report #
Reports are handled through the contact address above. I may ask for clarification or a minimal reproduction to understand the impact. This is a personally maintained site, not a staffed security response service, so there is no guaranteed acknowledgement or resolution deadline. If you have not heard back, please follow up in the same email thread.
Please coordinate public disclosure so there is a reasonable opportunity to investigate and address the issue. Avoid publishing sensitive evidence or details that put visitors at risk while a report is being assessed. Reporting does not create a promise of payment, a bug bounty, or public credit; any such arrangement would need to be agreed separately.
Contact and updates #
Security contact: [email protected]. A machine-readable contact record is available at /.well-known/security.txt, using the security.txt standard.
This policy may be updated as the website changes. The revision date above identifies the current version.