Security disclosure

DigiNepal is powered by axz.si. We rely on the security community to help keep user data safe.

Report a finding

Use the form below. The report goes directly to the project lead.

What we do

Acknowledge your report within 48 hours.
Triage and confirm reproducibility within 5 working days.
Coordinate disclosure timing with you; we credit researchers unless they request otherwise.

Scope

In scope: diginpl.com, apidiginpl.com, the iOS / Android / desktop apps, and any signed installer under /download/files/.

Out of scope: denial-of-service, social engineering of DigiNepal staff, physical security of the data centre, third-party services that DigiNepal does not operate.

Safe harbour

Good-faith research that follows this policy and does not access, alter, or exfiltrate user data will not be subject to legal action.