1. Scope
This policy explains how to report suspected vulnerabilities in bhim.si or BHIM-provided software, and outlines responsibilities for self-managed deployments. It is not a certification, an availability commitment, or a guarantee that every threat will be prevented.
2. Report a vulnerability
Email team@bhim.si with the subject “Security report”. Include the affected URL or software version, a concise description, prerequisites, safe reproduction steps, expected impact, and redacted supporting evidence. Do not send live credentials, private keys, or unnecessary personal information.
3. Research boundaries
This page is a reporting channel, not blanket authorisation to test systems. Obtain express permission before active testing of BHIM-controlled services. Do not conduct denial-of-service tests, social engineering, credential attacks, persistence, destructive actions, or access to other users’ data. Third-party and customer systems require their operators’ permission.
4. If you encounter sensitive data
Stop testing once you have enough information to demonstrate the issue safely. Do not download, alter, retain, or disclose unrelated records. Tell us what was exposed using redacted evidence and avoid including the sensitive data itself in ordinary email.
5. Coordinated disclosure
Please give us a reasonable opportunity to investigate and address a report before publishing details that enable exploitation. We may ask for clarification and coordinate disclosure with affected maintainers or providers. Response and remediation times depend on severity and complexity; no fixed service level or bounty is promised by this policy.
6. Self-managed deployment security
Keep the operating system and BHIM KVH version current, limit administrative permissions, secure configuration and logs, maintain backups, and test recovery procedures. Review allowlists and blocking rules before enabling them. Monitor health and incidents and retain an independent way to regain server access.
7. Protection limits
DoS protection, WAF rules, detection, and blocking depend on the installed version, traffic path, configuration, and available server resources. They cannot guarantee prevention of every attack or compensate for an upstream link saturated by traffic. Use network controls, application security, patching, and backups alongside BHIM KVH.
8. Incident reporting and updates
For a suspected issue in BHIM software, share the affected version, timeline, and redacted indicators at team@bhim.si. An incident on your own server also requires your own response process and any applicable notification obligations. Review release information and this policy for updates.