Responsible Disclosure

Anuma holds catalogs, rate cards, and conversations that businesses depend on. If you find a way to break that trust, we want to hear it from you first, and we will treat you as a colleague, not a threat.

How to report

Email security@anuma.co.in with what you found, the steps to reproduce it, and the impact you believe it has. Proof-of-concept material helps; screenshots and request traces are usually enough. We acknowledge every report within 48 hours, give you a triage verdict within 7 days, and keep you posted until the issue is resolved.

Our commitment to you

• Safe harbour. We will not initiate legal action against research conducted in good faith within these guidelines, and we will not report it to law enforcement.
• Credit. We run no paid bounty programme today, but with your permission we credit resolved reports.
• Transparency. If your report touches merchant data, we will tell the affected merchants and, where the law requires, the Data Protection Board of India.

Ground rules

• Access only what you need to demonstrate the issue. No exfiltrating data beyond proof, no modifying or destroying data that is not yours.
• No service disruption: no denial-of-service, load testing, or spam against the platform or its merchants.
• No social engineering or phishing of Anuma staff or merchants, and no physical attacks on infrastructure.
• Use your own test accounts wherever possible, and stop and report immediately if you reach someone else’s data.

Scope

In scope: anuma.co.in and its subdomains, the Anuma merchant and admin applications, our APIs, and the voice and messaging intake surfaces we operate, including prompt-injection and policy-bypass attacks against our agent functions (for example, making the negotiation agent cross a configured floor). Out of scope: third-party platforms we build on (Meta, payment gateways, cloud providers), findings that require stolen credentials, and reports from automated scanners with no demonstrated impact.

Coordinated disclosure

Give us 90 days from acknowledgement before publishing, and longer only if we agree it is needed for a fix that protects merchants. We are happy to coordinate the writeup and the timeline with you.