Report a security problem

Write to security [at] trackparcel.in, or use the contact form's “Security report” topic. Please write in English, and one problem per report helps us move faster.

Please include:

• what you found, and where: the address, the page or the API endpoint
• the steps that show it, with the requests or code you used
• what someone could do with it
• how to reach you, and the name to thank you by if you'd like credit

We acknowledge every report within 2 business days, tell you what we found, and keep you posted until the problem is fixed.

• www.trackparcel.in, the public site and its parcel tracker
• app.trackparcel.in, TrackParcel for Business
• the admin sign-in page
• the Business API
• the TrackParcel API (/api/v1/track)

• volumetric denial of service: flooding a site or an API with traffic
• social engineering of our team, our customers or anyone else
• physical access to offices, devices or servers
• third-party services we use, such as Supabase, Cloudflare, Razorpay and the couriers: report those to the service itself
• scanner output without a working proof
• missing security headers, or other best-practice findings, without an impact you can show
• self-XSS: script that only runs in your own browser because you put it there

• Test only with your own accounts and workspaces.
• Never read, change or delete other people's data, and never delete or change a shipment or tracking number.
• Stop at the first personal data you see, don't keep a copy, and report it to us.
• Give us 90 days to fix a problem before you disclose it, and tell us before you do.

If you follow these rules and report in good faith, we treat your research as authorised: we won't take legal action against you over it, or ask anyone else to, and if someone else does, we will say that you had our permission.

There is no paid bug bounty at launch. We thank everyone who reports a real problem and, with your permission, credit you by name when we announce the fix.