Bug Bounty Program

On this page

1. Program Overview

Carnatic Foods Private Limited ("Company", "we", "us") operates the raagas Platform and takes the security of its Users, systems, and data seriously. The Company values the contributions of the information security research community and believes that coordinated, responsible disclosure of security vulnerabilities is essential to maintaining the safety, privacy, and trust of all Users.
This Bug Bounty Program ("Program") is designed to encourage and reward independent security researchers who identify and responsibly report valid security vulnerabilities in the Company's in-scope assets. The Program is operated by Carnatic Foods Private Limited (CIN: U56100TN2025PTC180902) and is governed by these terms, the Terms and Conditions (raagas.co.in/legal/terms), and all Applicable Laws of India.
Participation in this Program is voluntary. By participating, You agree to comply with these terms and all Applicable Laws, including the Information Technology Act, 2000.

2. Scope

2.1 In-Scope Assets

raagas.co.in (primary website) and all subdomains (*.raagas.co.in)
raagas Web APIs and backend services (api.carnaticfoods.com)
raagas iOS application (when launched)
raagas Android application (when launched)
raagas Delivery Partner application (future)
raagas POS (Point of Sale) system (future, when applicable)
Authentication and authorisation systems (Cognito integration, JWT, OTP flows)
Payment processing flows and integrations (excluding Cashfree infrastructure — see Section 5)
User data handling, storage, and access control systems
Session management and token handling mechanisms
Order processing, cart, and checkout systems
Delivery tracking and real-time communication systems

2.2 Out-of-Scope

Third-party services and infrastructure: Payment gateways (Cashfree Payments), CDNs (CloudFront), cloud providers (AWS infrastructure), analytics providers (Google Analytics, Sentry), and any other third-party service not directly operated by the Company. Vulnerabilities in these services should be reported directly to the respective third-party provider.
Social media accounts: @raagasofficial and related accounts on Instagram, Facebook, X (Twitter), LinkedIn, and other social media platforms.
Physical security: Physical security of raagas outlets, kitchens, offices, data centres, or premises.
Social engineering: Phishing, pretexting, vishing, tailgating, or any form of social engineering attack directed at Company employees, contractors, Delivery Partners, or customers.
Denial of Service: Denial of Service (DoS), Distributed Denial of Service (DDoS), resource exhaustion, or any attack intended to degrade, disrupt, or render unavailable the Company's services.
Third-party dependencies: Vulnerabilities in third-party libraries, frameworks, or packages, unless the vulnerability is directly exploitable in the context of the Company's systems and results in a demonstrable security impact.

3. Qualifying Vulnerabilities

3.1 Critical Severity (Rs. 25,000 - Rs. 50,000)

Remote Code Execution (RCE) on production servers or infrastructure
SQL Injection or NoSQL Injection with demonstrated data exfiltration capability
Authentication bypass affecting all users or administrative access
Payment fraud vulnerabilities (price manipulation, payment bypass, free orders)
Privilege escalation from regular user to administrator or system-level access
Domain or subdomain takeover of a production asset
Complete Account Takeover (ATO) chain exploitable without victim interaction
Server-Side Request Forgery (SSRF) with access to internal services or cloud metadata

3.2 High Severity (Rs. 15,000 - Rs. 25,000)

Stored Cross-Site Scripting (XSS) affecting multiple users with demonstrated impact
Insecure Direct Object Reference (IDOR) exposing sensitive user data (PII, addresses, order history, payment identifiers)
Authentication or authorisation flaws (e.g., broken access control, role bypass)
Sensitive data exposure (unencrypted PII, payment information leakage, internal API keys)
Cross-Site Request Forgery (CSRF) on critical actions (checkout, payment, profile modification, address changes)
JWT, session token, or OTP vulnerabilities (prediction, replay, fixation, insecure storage)

3.3 Medium Severity (Rs. 5,000 - Rs. 15,000)

Reflected Cross-Site Scripting (XSS) requiring user interaction with demonstrated exploit
Information disclosure (internal file paths, configuration details, stack traces, debug information)
Session management issues (session fixation, inadequate session expiry, concurrent session abuse)
Rate limiting bypass with demonstrated abuse potential (brute force OTP, credential stuffing)
Business logic flaws with demonstrable impact (coupon abuse, price manipulation via API, order flow bypass)
Missing security headers with a demonstrated, working exploit (not merely the absence of a header)

3.4 Low Severity (Rs. 2,500 - Rs. 5,000)

Self-XSS requiring unlikely or complex user action (e.g., user must paste malicious code into their own browser console)
Open redirects with limited but demonstrable security impact
Verbose error messages that expose internal system details, version numbers, or stack traces
Minor information leakage (non-sensitive metadata, internal hostnames)
UI redressing (clickjacking) with limited but demonstrated impact on user actions

4. Exclusions (Non-Qualifying Issues)

4.1 Technical Exclusions

Automated vulnerability scanner output without manual validation and confirmed exploitability
Publicly disclosed CVEs (Common Vulnerabilities and Exposures) that have been published within the last ninety (90) days, unless a Company-specific exploit is demonstrated
Vulnerabilities that require physical device access, USB debugging, or rooted/jailbroken devices
Clickjacking or UI redressing without a demonstrated, material security impact
Missing security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options) without a working, demonstrated exploit that leverages the missing header
SSL/TLS configuration issues (weak ciphers, protocol version, certificate transparency) without demonstrated exploitability
Server version or technology banner disclosure (e.g., "Server: nginx", "X-Powered-By: Express")
Missing rate limiting without a demonstrated abuse scenario and real-world impact

4.2 Policy and Theoretical Issues

Password complexity, OTP length, or authentication policy suggestions without a demonstrated bypass
Logout CSRF (cross-site request forgery on the logout endpoint)
Theoretical or speculative vulnerabilities without a working Proof of Concept that demonstrates real-world exploitability
Best practice recommendations, hardening suggestions, or compliance observations that do not represent exploitable vulnerabilities
Issues reproducible only on outdated browsers (more than two major versions behind the current stable release)

4.3 Out-of-Scope Activities

Self-XSS that requires the victim to paste code into their own browser developer console
Email security misconfigurations (SPF, DKIM, DMARC) without a demonstrated, working exploit (e.g., email spoofing with content delivery)
Subdomain takeover claims without a working Proof of Concept (e.g., merely pointing to an unclaimed CNAME is insufficient without demonstrating content injection)
Duplicate reports: Only the first valid report of a unique vulnerability is eligible for reward
Issues already known to the Company or currently in the process of being remediated

5. PCI-DSS and Payment Security Testing

The Company's payment processing is handled by Cashfree Payments, a PCI-DSS Level 1 certified Payment Aggregator authorised by the Reserve Bank of India. The Company takes payment security extremely seriously.
Payment flow testing under this Program is STRICTLY LIMITED to the following: (a) testing for business logic flaws in the Company's Order and checkout flow (e.g., price manipulation, discount bypass, cart tampering) using the researcher's own Account and own funds; (b) testing for authorisation and access control issues in payment-related API endpoints.
The following activities are STRICTLY PROHIBITED and shall result in immediate disqualification, termination of the researcher's participation, and potential legal action: (a) attempting to access, exfiltrate, or store any real cardholder data (card numbers, CVVs, PINs, track data, or full magnetic stripe data); (b) testing against Cashfree Payments' infrastructure, SDKs, iframes, or hosted payment pages; (c) attempting to process fraudulent transactions, manipulate settlement amounts, or exploit payment gateway vulnerabilities; (d) any activity that could compromise the PCI-DSS compliance scope of the Company or its payment service providers.
Any accidental access to cardholder data or payment credentials during testing must be reported immediately to care@raagas.co.in and all such data must be securely deleted without retention, copying, forwarding, or disclosure. Failure to comply shall constitute a criminal offence under the Information Technology Act, 2000 and may result in referral to law enforcement authorities.

6. Rules of Engagement

6.1 Mandatory Requirements

Allow reasonable time for the Company to investigate and respond before following up on submitted reports.
Do not access, download, modify, delete, or exfiltrate real user data. Testing must be limited to Your own test Account(s) and synthetic data.
Do not perform destructive, disruptive, or degradative testing, including but not limited to: data deletion, data corruption, service disruption, resource exhaustion, or denial of service.
Do not exploit any discovered vulnerability beyond the minimum necessary to produce a valid Proof of Concept. Exploitation for personal gain, data theft, or any purpose other than demonstrating the vulnerability is strictly prohibited.
Use only test Accounts that You own and control for all demonstrations and Proof of Concepts.
Do not violate any Applicable Laws, including the Information Technology Act, 2000 (Sections 43, 65, 66, and 66A-66F), the Bharatiya Nyaya Sanhita, 2023, and any other Indian or international cyber law.
Do not publicly disclose any vulnerability, exploit details, Proof of Concept code, or related information without the Company's prior written consent. See Section 7.4 (Responsible Disclosure) for the coordinated disclosure process.
Report discovered vulnerabilities promptly and completely. Do not sit on vulnerabilities or delay reporting.

6.2 Best Practices

Submit one vulnerability per report. Chain exploits that combine multiple vulnerabilities into a single attack vector may be submitted as a single report.
Provide clear, detailed, step-by-step reproduction instructions that enable the Company's security team to independently verify the vulnerability.
Minimise Your access to only what is strictly necessary to demonstrate the vulnerability. Do not escalate access beyond what is needed for the Proof of Concept.
If You accidentally access sensitive data (user PII, payment information, internal credentials), stop testing immediately, do not retain or copy the data, and report the incident to care@raagas.co.in without delay.

7. Reporting Process

7.1 How to Submit

Email: care@raagas.co.in
Subject line format: [Security] <Severity> - <Brief Description>
Example: [Security] High - IDOR in Order History API Exposes User PII
For sensitive or critical findings, researchers may encrypt their report using the Company's PGP public key (available upon request from care@raagas.co.in).

7.2 Required Information

Vulnerability type and classification (e.g., XSS, IDOR, SSRF, SQLi) and Your assessed severity level
Affected URL, API endpoint, parameter, or component
Detailed, step-by-step reproduction instructions (including tools used, request/response examples, and environment details)
Proof of Concept: screenshots, screen recordings, HTTP request/response logs, code snippets, or other artefacts that demonstrate the vulnerability
Impact assessment: A realistic attack scenario describing how the vulnerability could be exploited in a real-world context and the potential consequences
Your contact details: email address and phone number (for communication regarding the report)
Disclosure of any accidental access to user data or sensitive information encountered during testing
Suggested remediation or mitigation approach (optional but appreciated and may positively influence the reward amount)

7.3 Response Timeline

Acknowledgment of receipt: Within three (3) Business Days
Initial triage and assessment: Within seven (7) Business Days
Severity assessment and classification: Within fourteen (14) Business Days
Remediation and fix deployment: Thirty (30) to ninety (90) days based on severity and complexity
Reward payment: Within thirty (30) days of fix verification and deployment

7.4 Responsible Disclosure

The Company follows a ninety (90) day coordinated disclosure timeline. Researchers agree not to publicly disclose vulnerability details, exploit code, Proof of Concept demonstrations, or any related technical information until: (a) ninety (90) days have elapsed from the date the Company acknowledged receipt of the report, OR (b) the Company has confirmed that the vulnerability has been remediated and deployed to production — whichever occurs first.
Any public disclosure must be agreed upon in writing by both the researcher and the Company. The Company may request reasonable modifications to the disclosure to protect User safety, remove sensitive technical details, or prevent exploitation of the vulnerability in environments that have not yet been patched.
Disclosure without written consent shall constitute a material breach of these Program terms and may result in disqualification from the Program, forfeiture of rewards, and legal action.

8. Safe Harbor

The Company believes that security research conducted in good faith, in compliance with this Program, and in accordance with Applicable Laws should be encouraged and protected.
Security research conducted in strict compliance with this Program's terms is considered authorised activity by Carnatic Foods Private Limited. The Company will not initiate or pursue civil litigation or criminal complaints against researchers who comply with all terms of this Program, including the Rules of Engagement, Scope limitations, and PCI-DSS restrictions.
If a legal action or inquiry is initiated by a third party against a researcher for activities conducted in good faith compliance with this Program, the Company shall take reasonable steps to clarify to the relevant authority that the researcher's actions were authorised under this Program.
The Company shall work collaboratively with researchers to understand and resolve reported issues in a timely manner.
This Safe Harbor is conditional upon the researcher: (a) making a genuine, good-faith effort to avoid privacy violations, data destruction, service disruption, and harm to Users; (b) complying with all Rules of Engagement and Scope limitations; (c) complying with all Applicable Laws of India, including the Information Technology Act, 2000 (Sections 43, 65, 66, and 66C-66F); and (d) not accessing, retaining, copying, or disclosing real user data.
This Safe Harbor does NOT extend to research that: violates the Rules of Engagement; exceeds the defined Scope; targets out-of-scope systems; involves social engineering, physical security testing, or denial of service; violates any Applicable Law; or is conducted with malicious intent.

9. Rewards and Recognition

9.1 Cash Rewards

Critical Severity: Rs. 25,000 - Rs. 50,000
High Severity: Rs. 15,000 - Rs. 25,000
Medium Severity: Rs. 5,000 - Rs. 15,000
Low Severity: Rs. 2,500 - Rs. 5,000
All rewards are paid via NEFT/IMPS bank transfer or UPI to an Indian bank account designated by the researcher.

9.2 Reward Terms

The final reward amount within the applicable range is at the sole discretion of the Company, determined based on: the severity and real-world exploitability of the vulnerability, the potential impact on Users and business operations, the quality, clarity, and completeness of the report and Proof of Concept, and the researcher's adherence to the Rules of Engagement.
Only the first valid reporter of a unique, previously unreported vulnerability is eligible for a reward. Duplicate reports (reporting a vulnerability that has already been reported or is already known to the Company) are not eligible.
Rewards constitute taxable income under Indian tax law. Researchers are solely responsible for all applicable tax obligations, including income tax, TDS (Tax Deducted at Source) where applicable, and GST (if the researcher is registered under GST). The Company may deduct TDS as required by law before disbursing the reward.
Payment shall be processed within thirty (30) days of the Company verifying the fix and confirming remediation in the production environment.

9.3 Eligibility

Independent security researchers — individuals or groups — who are not affiliated with the Company.
Must be at least eighteen (18) years of age, or have verifiable parental or guardian consent.
Must not be a current or former (within the last twelve months) employee, contractor, consultant, intern, or vendor of Carnatic Foods Private Limited or its affiliates.
Must not reside in or be a national of a country that is subject to trade sanctions, export controls, or embargoes imposed by the Government of India or the United Nations Security Council.

9.4 Hall of Fame

Researchers who report valid, qualifying vulnerabilities may be publicly recognised on the Company's Security Hall of Fame page (if and when published on the Platform), subject to the researcher's express written consent.
Acknowledgment in security advisories for critical and high-severity findings that result in significant security improvements.
Special recognition and thank-you communication for exceptional contributions to the security of the Platform.
Certificate of appreciation available upon request for verified, qualifying reports.
All recognition is at the Company's sole discretion, based on the impact, quality, and significance of the reported vulnerability and the researcher's cooperation throughout the process.

10. Program Terms

Contact: care@raagas.co.in (expected initial response within three (3) Business Days)
Entity: Carnatic Foods Private Limited (CIN: U56100TN2025PTC180902)
Registered Office: Plot No. 87, Sun Garden, Morattandi, Auroville, Vanur, Villupuram, Tamil Nadu 605101, India
Program effective date: February 2026
The Company reserves the right to modify, suspend, or discontinue this Program at any time, without prior notice and without liability, at its sole discretion. Any changes to the Program terms shall be effective upon publication on this page.
Participation in this Program constitutes acceptance of raagas Terms and Conditions (raagas.co.in/legal/terms) and this Program's terms.
The Company may retain communications, reports, and related materials submitted under this Program for Program administration, security improvement, legal compliance, and dispute resolution purposes.
Any unlawful exploitation of discovered vulnerabilities — including but not limited to data theft, service disruption, financial gain, extortion, or blackmail — shall result in immediate disqualification, forfeiture of all rewards, and referral to law enforcement authorities for criminal prosecution under the Information Technology Act, 2000 (including Sections 43, 65, 66, 66C, 66D, and 66F), the Bharatiya Nyaya Sanhita, 2023, and any other Applicable Laws.
This Program and all disputes arising hereunder shall be governed by the laws of India, and the courts at Villupuram, Tamil Nadu shall have exclusive jurisdiction.

Contact

For questions about this policy, contact:

Carnatic Foods Private Limited

CIN: U56100TN2025PTC180902

Registered Office: Plot No. 87, Sun Garden, Morattandi, Auroville, Vanur, Villupuram, Tamil Nadu 605101, India

Email: care@raagas.co.in

Designation: Director, Grievance Redressal Officer, Nodal Officer & Data Protection Officer

Grievance and DPO Email: care@raagas.co.in