Security & Vulnerability. Architecture & Safe Harbor.
System Status: Active • Security Standard: Zero-Surveillance • Publisher: Cibru Interactive (cibru.in)
1. System Security Architecture
At Cibru Interactive, security is an architectural baseline. We reject telemetry-heavy, centralized architectures in favor of local-first computing and zero-trust boundaries:
Applications like Export Chat Reader process chat files entirely in on-device sandboxes, preventing remote exfiltration.
Web APIs enforce Next.js server-only boundaries, Cloudflare Turnstile token validation, and keyed HMAC rate-limit hashing.
2. Data Protection Standards
- Zero Plaintext Credential Storage: Payment cards and banking details are processed exclusively through PCI-DSS Level 1 tokenized gateways (Razorpay). Cibru servers never see or store CVVs or card numbers.
- Automated Data Lifecycle: Website contact messages are hard-deleted after 365 days. Bot prevention rate-limit records are wiped every 24 hours.
- Transport Security: Strict HTTPS with HSTS (HTTP Strict Transport Security) and modern TLS 1.3 encryption across all web properties.
3. Vulnerability Disclosure Policy (VDP)
We welcome reports from independent security researchers and ethical hackers. If you discover a vulnerability in our web infrastructure or mobile applications, we encourage you to report it to us responsibly:
If you conduct vulnerability research in good faith and comply with this policy, we will not pursue civil action or initiate law enforcement complaints against you.
- In-Scope:
cibru.inweb domains, API endpoints (/api/contact), and officially published Android application binaries on the Google Play Store. - Out-of-Scope: Denial of Service (DoS/DDoS) attacks, brute-force volume testing, social engineering/phishing of staff, physical security attacks, and issues in third-party services (e.g. Supabase, Cloudflare, Razorpay) unless directly exploitable in our implementation.
Email your detailed report to security@cibru.in or support@cibru.in (with a copy to thekrishna0359@gmail.com). Please include:
- Description of the vulnerability and its potential impact.
- Exact reproduction steps, Proof of Concept (PoC) scripts, or screenshots.
- Target URL, parameter, or application version.
4. Response Timelines & Recognition
- Acknowledgment: We commit to acknowledging receipt of your vulnerability report within 48 hours.
- Assessment & Triage: Initial assessment and validation within 5 business days.
- Resolution: Remediation deployed typically within 14 to 30 days, depending on severity.
- Recognition: Valid disclosures that protect our users will be credited on our official Hall of Fame upon mutual consent.