SkillShikshya

SkillShikshya is an IT training institute and upskilling center based in Kathmandu, Nepal, focused on practical, project-based education. We are inviting security researchers to help identify vulnerabilities in our web application before they can be exploited.

Scope

• In-scope: *.skillshikshya.com (add all domains/subdomains owned by the organization)
• Out-of-scope: third-party services (payment gateways, email providers, hosting/CDN infrastructure), admin panels you don't own, student/personal accounts.

Testing Windows

• Testing allowed 24/7 unless otherwise specified. Avoid peak business hours for aggressive scans.
• No testing during known maintenance windows or exams/critical enrollment periods.

Allowed Techniques

• Manual testing and automated scanning with rate limits (max ~10 req/sec) to avoid denial of service.
• SQLi, XSS, IDOR, auth bypass, business logic flaws — report with proof of concept.
• Only create one (1) test account; do not access, modify, or exfiltrate data of real users.

Prohibited Techniques

• DoS/DDoS, stress testing, brute force (password spraying, credential stuffing).
• Social engineering, phishing, or physical attacks.
• Malware/ransomware deployment or persistence mechanisms.
• Pivoting to internal networks or lateral movement.
• Uploading shells/backdoors. If a file upload vuln is found, use a harmless proof (e.g., test.html with your handle) and delete it after confirmation.
• Public disclosure before the vendor resolves the issue.

Data Handling

• Access the minimum data necessary to demonstrate impact; do not download, store, or share personal data. If PII is accidentally exposed, report immediately and delete your copies.
• Do not modify or delete user data, even your own, beyond what's needed to demonstrate the issue.

Escalation / Reporting

• Report via platform only. Mark duplicate/known issues as such.

• Retest after fix — do not re-exploit confirmed-resolved issues.

Legal

• Researcher agrees to operate in good faith and complies with applicable law. Responsible disclosure policy applies; no legal action will be taken against researchers acting within these rules.

SkillShikshya is committed to the security of our users' data and welcomes the responsible disclosure of vulnerabilities by security researchers.

1. Our Commitment to Researchers

When you report a vulnerability in good faith and in accordance with this policy, we commit to:

• Not pursue legal action against you for your research activities.
• Work with you to understand and resolve the issue promptly.
• Give credit (unless you wish to remain anonymous).
• Provide reward/recognition for valid, in-scope findings per our bounty table.
• Keep you informed of remediation progress.

2. Researcher's Responsibilities

By participating in this program, you agree to:

• Report vulnerabilities privately through this platform only — never publicly before resolution.
• Give us a reasonable timeframe (90 days by default) to investigate and fix before any disclosure.
• Make a good faith effort to avoid privacy violations, data destruction, and service disruption.
• Access only the minimum data needed to demonstrate impact; delete any inadvertently obtained data.
• Use a single test account; never interact with real user accounts or data.
• Cease testing on a system once a vulnerability is confirmed.