Anuma holds catalogs, rate cards and conversations that businesses depend on. If you find a way to break that trust, we want to hear it from you first, and we will treat you as a colleague, not a threat.
How to report
Email security@anuma.co.in with what you found, the steps to reproduce it, and the impact you believe it has. Proof-of-concept material helps; screenshots and request traces are usually enough. We acknowledge every report within 48 hours, give you a triage verdict within 7 days, and keep you posted until the issue is resolved.
Our commitment to you
- Safe harbour. We will not initiate legal action against research conducted in good faith within these guidelines, and we will not report it to law enforcement.
- Credit. We run no paid bounty programme today, but with your permission we credit resolved reports.
- Transparency. If your report touches client data, we will tell the affected clients and, where the law requires, the Data Protection Board of India.
Ground rules
- Access only what you need to demonstrate the issue. No exfiltrating data beyond proof, no modifying or destroying data that is not yours.
- No service disruption: no denial-of-service, load testing, or spam against the platform or its clients.
- No social engineering or phishing of Anuma staff or clients, and no physical attacks on infrastructure.
- Use your own test accounts wherever possible, and stop and report immediately if you reach someone else’s data.
Scope
In scope: anuma.co.in and its subdomains, the Anuma applications, our APIs, and the messaging and voice intake surfaces we operate, including prompt-injection and policy-bypass attacks against our agents (for example, making an agent act outside the rules a client has set). Out of scope: third-party platforms we build on (Meta, cloud providers), findings that require stolen credentials, and reports from automated scanners with no demonstrated impact.
Coordinated disclosure
Give us 90 days from acknowledgement before publishing, and longer only if we agree it is needed for a fix that protects clients. We are happy to coordinate the writeup and the timeline with you.