Report security issues safely.
This policy covers the public Banao / SYNTHCODE GOV evaluator operated by Syntheon Technology Private Limited. Please do not test against third-party, department, citizen or production systems without explicit authorization.
How to report
Email syntheontech@gmail.com with a concise description, affected URL or component, reproduction steps, impact, and any non-sensitive evidence needed to understand the issue.
Safe-testing boundary
- Use only data, repositories and accounts you own or are explicitly authorized to test.
- Do not access, retain or disclose citizen information, credentials, private repository contents, or third-party secrets.
- Do not perform denial-of-service, destructive testing, social engineering, persistence, or production mutation.
- Stop testing and report immediately if you unexpectedly encounter sensitive data.
Evaluator architecture boundary
The public evaluator intentionally denies protected merge and production deployment authority. Private/restricted repository execution, department identity, institution-managed signing, durable institutional audit storage and protected change-management are pilot integrations and are not represented as live department capabilities without authorized end-to-end proof.
Evidence & verification
Security-sensitive product claims are exposed through the Claim → Evidence Registry and live proof endpoints. PRAMAAN and evaluator proof packs distinguish SHA-256 integrity, DSSE/in-toto binding and institution-authorized signature state rather than treating them as equivalent.
Response expectations
Good-faith reports will be reviewed and triaged. Please allow reasonable time for investigation and remediation before public disclosure. This page is a disclosure policy, not a bug-bounty promise or authorization to test systems outside the public evaluator.