1. Security Architecture & Data Protection
BatchLoop safeguards student information across colleges affiliated with Dr. Babasaheb Ambedkar Marathwada University (BAMU) by implementing zero-trust authentication, cryptographic HMAC handshakes for offline verification, and strict institutional privacy boundaries under India's Digital Personal Data Protection (DPDP) Act, 2023.
2. Responsible Disclosure Program
We welcome security researchers, ethical hackers, and student computer engineers to inspect our public interfaces and report potential security vulnerabilities responsibly.
Program Commitments (Safe Harbor):
- We will not initiate legal action against researchers acting in good faith under this policy.
- We acknowledge and triage all verified vulnerability submissions within 24 hours.
- Qualifying researchers will receive public Hall of Fame attribution on our security wall.
3. In-Scope Targets
In Scope
- BatchLoop Exchange (`batchloop.site`)
- BatchLoop Rides API & Web Engine
- Cross-App SSO Ticket Bridge
- Dual-Party Cryptographic Handshake Protocol
- Firestore Security Rules & Auth Guards
Out of Scope
- Denial of Service (DoS / DDoS) attacks
- Social engineering or phishing of college students
- Physical security attacks on campus premises
- Automated spamming of listing comment fields
4. Submitting a Vulnerability Report
If you discover a vulnerability, submit a detailed report to our dedicated security desk:
Please include: reproduction steps, HTTP request/response payloads, potential impact assessment, and screenshots or PoC scripts. Allow us 48 hours to validate and resolve before public disclosure.