Vulnerability disclosure policy
Last updated: 2026-10-19
We welcome reports of security vulnerabilities in our websites. This policy sets out what is in scope, how to report, and what you can expect from us. Report to security@trinitytech.com.np. Machine-readable details are in /.well-known/security.txt.
Scope
trinitytech.com.np and all of its subdomains.
Out of scope
- Denial of service, load or stress testing.
- Social engineering of our staff, including phishing.
- Physical attacks against our offices or equipment.
- Third-party services we don't control. Report those to the vendor.
- Automated scanner output without demonstrated impact.
How to report
Email security@trinitytech.com.np with:
- the affected URL or host;
- the steps to reproduce;
- the impact, as you understand it;
- a proof of concept, such as a request, script or screenshot.
Do not access, modify or delete other users' data beyond what is needed to demonstrate impact. If you reach personal data, stop, and tell us in your report.
What we commit to
- We acknowledge your report within 3 business days (Sunday to Friday, Nepal time).
- We send a status update within 10 business days.
- We coordinate disclosure with you: after the fix ships, or 90 days after your report, whichever comes first.
Recognition
We do not run a monetary bug bounty. With your permission, we will thank you by name on this page once the issue is fixed.
Good-faith safe harbour
If you follow this policy, we consider your research authorized and will not pursue legal action against you for it.