Reporting a vulnerability

Email pavanmaguluri@usvisaplatform.com with enough detail to reproduce the problem — the URL or request, what you did, and what happened that should not have. A short description with exact steps is worth more than a scanner report.

Please report privately in the first instance rather than posting publicly, so that anyone whose data is affected is not exposed while it is being fixed.

We will acknowledge your report, tell you whether we have been able to reproduce it, and let you know when it is fixed.

We cannot promise a response within a fixed number of hours. This is a small operation and an SLA we could not keep would be worth less to you than an honest expectation: reports are read by a person, not a queue, and urgent ones are treated as urgent.

Please do not access, modify or delete data belonging to anyone else. If a flaw exposes someone’s personal information, stop at the point where you have demonstrated it and tell us — you do not need to enumerate records to prove the finding.

Please do not run denial-of-service tests, send bulk automated traffic, or attempt social engineering against anyone working here or applying through us.

This site and the applicant portal are in scope. Third-party services we use are not ours to authorise testing against — report those to the service concerned.

The U.S. government systems referenced throughout this site are emphatically not in scope. We are an independent service with no relationship to them, and nothing here authorises testing anything they operate.

We do not run a bounty programme and cannot offer payment. We will thank you, and we will credit you when a report leads to a fix if you would like us to. Saying so plainly seems better than implying a reward that does not exist.

The same contact details are published at /.well-known/security.txt in the format described by RFC 9116.