Responsible Disclosure Policy 

1. Purpose of this Policy

The purpose of this Policy is to: 

1. Encourage responsible reporting of security vulnerabilities. 
2. Provide a clear reporting channel for security issues. 
3. Define which systems and activities are in scope. 
4. Define which testing activities are not allowed. 
5. Protect Galla.app customers, users, data, infrastructure, integrations, and hardware workflows. 
6. Help security researchers understand safe testing boundaries. 
7. Support coordinated remediation before public disclosure. 
8. Reduce the risk of accidental harm, data exposure, disruption, or misuse. 
9. Establish expectations for communication, timelines, and recognition. 
10. Clarify that this Policy is not a bug bounty programme unless expressly stated.

2. Scope

This Policy applies to security vulnerabilities affecting Galla.app systems, products, services, or assets that are owned, operated, or controlled by Treewalker Digital Private Limited. 

This may include: 

1. Galla.app website. 
2. Galla.app SaaS platform. 
3. Galla.app login and authentication flows. 
4. Retail Management module. 
5. POS Billing module. 
6. Warehouse Management module. 
7. Inventory Management module. 
8. WhatsApp Marketing module. 
9. Ecommerce management features operated by Galla.app. 
10. APIs and webhooks owned by Galla.app. 
11. Dashboards and reports. 
12. Customer admin panels. 
13. Support portals owned by Treewalker Digital Private Limited. 
14. Public-facing Galla.app domains and subdomains. 
15. Mobile or web applications officially released by Treewalker Digital Private Limited. 
16. Security issues in Galla-controlled integrations. 
17. Misconfiguration affecting Galla-owned cloud or application assets. 
18. Authentication, authorisation, access control, session, data exposure, or API security vulnerabilities in Galla-controlled systems. 

3. Out-of-Scope Systems 

The following are generally out of scope unless Treewalker Digital Private Limited gives written permission: 

1. Third-party websites not owned or controlled by Treewalker Digital Private Limited. 
2. Customer-owned ecommerce websites. 
3. Customer-owned ERP, accounting, marketplace, logistics, WhatsApp, payment gateway, SMS, email, or analytics accounts. 
4. Customer-controlled cloud infrastructure. 
5. Customer local networks. 
6. Customer POS devices, scanners, printers, handhelds, RFID devices, computers, tablets, or mobile devices. 
7. Third-party APIs, SDKs, plugins, themes, extensions, or applications. 
8. Social media pages. 
9. Public marketing pages hosted by third-party platforms, unless owned and controlled by Treewalker Digital Private Limited. 
10. Employee personal accounts. 
11. Vendor or partner systems. 
12. Service partner systems. 
13. Physical offices, facilities, warehouses, or data centres not directly controlled by Treewalker Digital Private Limited. 
14. Demo environments not specifically approved for testing. 
15. Beta, pilot, or customer-specific environments unless expressly authorised. 

If you are unsure whether a system is in scope, please ask us before testing. 

4. No Unauthorised Testing

You must not perform testing unless it complies with this Policy. 

Testing should be limited, safe, non-destructive, and designed to prove the existence of a vulnerability without causing harm. 

You must not: 

1. Access, view, copy, modify, delete, export, or disclose customer data. 
2. Disrupt Galla.app services. 
3. Degrade platform performance. 
4. Run denial-of-service or load tests. 
5. Conduct automated high-volume scanning. 
6. Conduct brute-force attacks. 
7. Attempt credential stuffing. 
8. Attempt password spraying. 
9. Attempt phishing or social engineering. 
10. Attempt physical security testing. 
11. Test employee devices or personal accounts. 
12. Test customer devices or customer networks. 
13. Access another customer’s account or data. 
14. Use malware, ransomware, spyware, worms, trojans, or harmful code. 
15. Exfiltrate data. 
16. Modify or delete data. 
17. Change account settings. 
18. Send unauthorised messages, emails, SMS, WhatsApp campaigns, or API requests that affect real users. 
19. Use payment gateways, WhatsApp, SMS, email, ecommerce, marketplace, logistics, or ERP integrations in a way that triggers real transactions or communication. 
20. Publicly disclose a vulnerability before coordinated remediation. 

5. Safe Testing Rules

When testing, you must follow these safe testing rules: 

1. Use only your own account or a test account that you are authorised to use. 
2. Keep testing limited to the minimum required to confirm the vulnerability. 
3. Do not access real customer data. 
4. Do not change, delete, or corrupt data. 
5. Do not perform tests that affect other users. 
6. Do not attempt persistence or lateral movement. 
7. Do not use exploit chains beyond what is necessary to prove impact. 
8. Do not run scanners at high volume. 
9. Do not bypass rate limits in a way that causes service impact. 
10. Do not attempt to access production infrastructure, shells, consoles, databases, or internal systems. 
11. Do not attempt to access secrets, keys, credentials, environment variables, or tokens beyond demonstrating that exposure exists. 
12. Stop testing immediately if you see data that does not belong to you. 
13. Stop testing immediately if service performance is affected. 
14. Report the issue promptly. 
15. Keep all findings confidential until Treewalker Digital Private Limited confirms remediation or gives written permission for disclosure. 

7. Vulnerabilities Usually Out of Scope 

The following reports are generally out of scope unless they demonstrate a clear, practical, and material security impact: 

1. Missing security headers without demonstrated exploitability. 
2. Clickjacking on pages with no sensitive action. 
3. Self-XSS requiring a user to attack themselves. 
4. Logout CSRF. 
5. Rate limiting issues without meaningful security impact. 
6. Username enumeration without additional impact. 
7. Email spoofing without proof of domain misconfiguration. 
8. SPF, DKIM, or DMARC suggestions without demonstrable risk. 
9. Missing cookie flags on non-sensitive cookies. 
10. Mixed content on non-sensitive marketing pages. 
11. Version disclosure without exploitability. 
12. SSL/TLS configuration issues rated low risk. 
13. Publicly available information. 
14. Best-practice recommendations without a vulnerability. 
15. Social engineering scenarios. 
16. Physical security issues. 
17. Denial-of-service vulnerabilities. 
18. High-volume automated scanner output without validation. 
19. Reports from outdated browsers or unsupported devices. 
20. Vulnerabilities in third-party platforms not controlled by Treewalker Digital Private Limited. 
21. Issues requiring malware installation on the user’s device. 
22. Issues requiring compromised user credentials. 
23. Issues caused by customer-side misconfiguration. 
24. Issues in customer-owned websites, devices, networks, or integrations. 
25. Theoretical vulnerabilities without a working proof or practical impact. 
26. Duplicate reports already known to us. 
27. Reports about lack of ISO/SOC certification. 
28. Content or grammar issues. 
29. UI or usability issues without security impact. 
30. Feature requests. 

8. Strictly Prohibited Activities

The following activities are strictly prohibited: 

1. Accessing customer accounts or data without permission. 
2. Accessing production databases. 
3. Exfiltrating data. 
4. Modifying, deleting, or corrupting data. 
5. Disrupting services. 
6. Denial-of-service testing. 
7. Load testing without written approval. 
8. Brute-force attacks. 
9. Credential stuffing. 
10. Password spraying. 
11. Phishing. 
12. Social engineering. 
13. Physical intrusion or facility testing. 
14. Testing employees, contractors, vendors, service partners, or customers. 
15. Installing malware. 
16. Uploading malicious files. 
17. Creating persistence. 
18. Attempting lateral movement. 
19. Accessing internal systems. 
20. Attacking third-party providers. 
21. Triggering real payment transactions. 
22. Sending real WhatsApp/SMS/email campaigns without authorisation. 
23. Accessing or changing hardware device configuration without permission. 
24. Tampering with POS, scanner, printer, RFID, handheld, tablet, or warehouse hardware. 
25. Public disclosure before remediation. 
26. Threatening disclosure, extortion, or ransom demand. 
27. Demanding compensation as a condition for disclosure. 
28. Using vulnerability information for commercial advantage against Galla.app or its customers. 
29. Any activity that violates applicable law. 
30. Violation of these rules may result in legal action, account suspension, termination, reporting to authorities, or other enforcement action. 

9. Reporting Channel

Please report suspected vulnerabilities to: 

Support Email: support@treewalkerlabs.com
Website: https://galla.app 

Use the subject line: 

Security Vulnerability Report - Galla.app 

If the issue is urgent or may expose customer data, please include URGENT in the subject line. 

10. What to Include in Your Report 

A good report helps us validate and fix the issue faster. 

Please include: 

1. Your name and contact details. 
2. Organisation name, if applicable. 
3. Affected domain, URL, API endpoint, module, or feature. 
4. Vulnerability type. 
5. Clear description of the issue. 
6. Step-by-step reproduction instructions. 
7. Proof-of-concept code, if safe and non-destructive. 
8. Screenshots or screen recording, if useful. 
9. Sample request and response, with sensitive data removed. 
10. Impact explanation. 
11. Whether any data was accessed. 
12. Whether any service disruption occurred. 
13. Whether the issue is still reproducible. 
14. Date and time of testing. 
15. Browser, device, operating system, and network details, if relevant. 
16. Any suggested remediation, if available. 
17. Whether you want public recognition, if eligible. 

Please do not include real customer data in the report. If you accidentally accessed data that does not belong to you, stop testing and notify us immediately. 

11. Handling of Accidental Data Access 

If you accidentally access data that does not belong to you: 

1. Stop testing immediately. 
2. Do not copy, save, export, modify, delete, screenshot, or share the data. 
3. Report the issue immediately. 
4. Tell us exactly what data was accessed. 
5. Tell us how the access occurred. 
6. Delete any locally stored sensitive information, if any, after receiving instruction from us. 
7. Do not disclose the data to anyone else. 
8. Cooperate with our investigation. 

Responsible handling of accidental access is important for customer privacy and legal compliance. 

12. Our Response Process 

After receiving a report, Treewalker Digital Private Limited will use reasonable efforts to: 

1. Acknowledge receipt of the report. 
2. Review the report for scope and completeness. 
3. Validate the vulnerability. 
4. Assess severity and business impact. 
5. Prioritise remediation. 
6. Request additional information, if required. 
7. Develop and test a fix or mitigation. 
8. Deploy a fix or workaround. 
9. Confirm remediation where practical. 
10. Close the report. 
11. Provide recognition if applicable and approved. 

Response times may vary depending on severity, report clarity, business impact, exploitability, affected systems, third-party dependency, and engineering workload. 

13. Target Communication Timelines 

The following are target timelines and not guaranteed service levels. 

Critical issues affecting customer data or active exploitation may be prioritised for faster handling. 

14. Severity Classification 

We may classify vulnerabilities based on impact and exploitability. 

Critical Severity 

Examples: 

1. Remote code execution. 
2. Authentication bypass affecting multiple customers. 
3. Unauthorised access to customer data across tenants. 
4. Full account takeover. 
5. Exposure of production secrets. 
6. Critical payment or billing security flaw. 
7. Active exploitation affecting customer data. 

High Severity 

Examples: 

1. Privilege escalation. 
2. Access to another user’s sensitive data. 
3. Significant API access control issue. 
4. Stored XSS with account impact. 
5. Sensitive business data exposure. 
6. Unauthorised export of data. 
7. Integration credential exposure. 

Medium Severity 

Examples: 

1. Reflected XSS with meaningful impact. 
2. CSRF affecting sensitive action. 
3. Limited information disclosure. 
4. Security misconfiguration with practical impact. 
5. Moderate business logic issue. 
6. Limited account or role bypass. 

Low Severity 

Examples: 

1. Low-impact security header issue. 
2. Non-sensitive information disclosure. 
3. Minor misconfiguration. 
4. Low-risk UI or session issue. 
5. Best-practice improvement. 

Final severity classification is determined by Treewalker Digital Private Limited. 

15. Remediation Timelines

Remediation timelines depend on risk, exploitability, technical complexity, product impact, testing requirements, third-party dependencies, and release cycles. 

General targets may be: 

Some issues may require temporary mitigation before permanent fix. 

Some findings may be accepted as business risk if impact is low or remediation is not practical. 

16. Coordinated Disclosure

We request that researchers give Treewalker Digital Private Limited reasonable time to investigate and remediate before any public disclosure. 

You must not publicly disclose details of a vulnerability without written permission from Treewalker Digital Private Limited. 

Public disclosure may include: 

1. Blog posts. 
2. Social media posts. 
3. Videos. 
4. Conference talks. 
5. Public bug databases. 
6. GitHub repositories. 
7. Exploit code. 
8. Proof-of-concept scripts. 
9. Screenshots. 
10. Press communication. 

We may approve coordinated public disclosure after remediation if it does not expose customers, systems, data, or sensitive technical details. 

17. Recognition

Treewalker Digital Private Limited may, at its discretion, recognise researchers who submit valid and helpful vulnerability reports. 

Recognition may include: 

1. Thank-you email. 
2. Public acknowledgement on a Hall of Fame page, if available. 
3. Certificate of appreciation, if available. 
4. LinkedIn mention, if approved by both parties. 
5. Private recommendation or acknowledgement, if appropriate. 

Recognition is not guaranteed and may depend on report quality, impact, responsible conduct, and compliance with this Policy. 

18. No Bug Bounty Unless Announced 

This Policy is not a bug bounty programme. 

Unless Treewalker Digital Private Limited has expressly announced a paid bug bounty programme in writing: 

1. No monetary reward is promised. 
2. No bounty amount is guaranteed. 
3. No compensation is owed for reports. 
4. No payment will be made for duplicate, low-impact, out-of-scope, or policy-violating reports. 
5. Demanding payment as a condition for disclosure is prohibited. 
6. Extortion, ransom, or threats of public disclosure are prohibited. 

Any reward, appreciation, or recognition is entirely at our discretion. 

19. Safe Harbour Statement 

Treewalker Digital Private Limited will not initiate legal action against researchers for good-faith security research conducted in compliance with this Policy. 

To remain eligible for this good-faith treatment, you must: 

1. Stay within the scope of this Policy. 
2. Follow safe testing rules. 
3. Avoid privacy violations. 
4. Avoid data access or exfiltration. 
5. Avoid service disruption. 
6. Avoid social engineering. 
7. Avoid physical attacks. 
8. Report the issue promptly. 
9. Keep the vulnerability confidential. 
10. Cooperate with our remediation process. 
11. Comply with applicable law. 
12. This safe harbour does not apply to activities that are unlawful, harmful, destructive, extortionate, fraudulent, disruptive, or outside this Policy. 

This safe harbour does not bind third parties, customers, cloud providers, WhatsApp/Meta, payment gateways, marketplaces, ecommerce platforms, logistics providers, or any other external service provider. 

20. Researcher Responsibilities 

Researchers must: 

1. Act in good faith. 
2. Follow this Policy. 
3. Avoid harm to customers or users. 
4. Avoid accessing personal data or business data. 
5. Avoid disrupting service. 
6. Avoid public disclosure before remediation. 
7. Avoid testing third-party systems without permission. 
8. Avoid social engineering. 
9. Avoid physical testing. 
10. Avoid extortion or pressure tactics. 
11. Provide clear and accurate reports. 
12. Cooperate with reasonable follow-up questions. 
13. Delete any accidentally obtained sensitive information as instructed. 
14. Comply with applicable law. 

21. Customer Responsibilities

Customers using Galla.app must report suspected security issues promptly. 

Customers should report: 

1. Suspicious login activity. 
2. Unauthorised account access. 
3. Unknown users in account. 
4. Exposed API keys. 
5. Exposed credentials. 
6. Unexpected data exports. 
7. Unknown integrations. 
8. Incorrect user permissions. 
9. Lost or stolen devices with active Galla.app access. 
10. Suspicious WhatsApp, SMS, email, or API activity. 
11. Unusual billing or warehouse activity. 
12. Suspected data breach. 

Customers are responsible for securing their own users, devices, passwords, networks, hardware, integrations, API keys, and third-party accounts. 

22. Hardware and Physical Testing Restrictions

Galla.app may be used with hardware such as POS devices, barcode scanners, QR scanners, RFID readers, RFID antennas, handheld terminals, tablets, printers, chargers, and accessories. 

Responsible disclosure for hardware-related issues is limited to issues affecting Galla.app-controlled software, firmware configuration, integration, or data security. 

You must not: 

1. Tamper with hardware that you do not own. 
2. Open, modify, or damage devices. 
3. Test customer-owned devices. 
4. Interfere with warehouse, POS, or retail operations. 
5. Attempt RFID interception in customer environments. 
6. Attempt barcode or QR manipulation in live customer environments. 
7. Test physical security of customer sites. 
8. Access hardware logs without permission. 
9. Attempt to bypass device restrictions in a way that affects customer operations. 
10. Conduct radio-frequency, wireless, or network attacks without written permission. 

Hardware defects, warranty claims, replacement requests, and service issues should be handled through the SLA and Support Policy and Refund, Billing, Cancellation, and Hardware Replacement Policy. 

23.  WhatsApp, SMS, Email, and Communication Testing Restrictions 

Because Galla.app may support WhatsApp Marketing, SMS, email, and customer communication workflows, you must not perform tests that send real messages or affect real recipients. 

You must not: 

1. Send test messages to real customers. 
2. Trigger WhatsApp campaigns. 
3. Trigger SMS or email campaigns. 
4. Modify templates. 
5. Access recipient contact lists. 
6. Export recipient data. 
7. Test opt-out workflows on real recipients. 
8. Trigger payment reminders or invoices. 
9. Send phishing or deceptive messages. 
10. Test WhatsApp/Meta systems directly through Galla.app without permission. 

Any communication workflow testing must be limited to accounts, numbers, and recipients you own or are authorised to use. 

24. Payment and Billing Testing Restrictions

You must not: 

1. Trigger real payments. 
2. Attempt payment fraud. 
3. Test stolen cards or unauthorised payment instruments. 
4. Manipulate invoices. 
5. Modify subscription records. 
6. Attempt to bypass billing controls. 
7. Create fake refunds. 
8. Access other customers’ billing data. 
9. Test third-party payment gateway vulnerabilities through Galla.app. 
10. Abuse coupons, trials, credits, or plan limits. 

If you find a billing-related vulnerability, report it with safe proof that does not affect real customer invoices, payments, or financial records. 

25. API Testing Restrictions

You may test APIs only if you are authorised to use the relevant API credentials and account. 

You must not: 

1. Use stolen, leaked, or unauthorised API keys. 
2. Access another customer’s API data. 
3. Exceed reasonable request volume. 
4. Bypass rate limits. 
5. Trigger large imports or exports. 
6. Send malicious payloads to disrupt services. 
7. Attempt mass enumeration. 
8. Use APIs to scrape data. 
9. Trigger real communication, billing, stock, or warehouse workflows. 
10. Test undocumented endpoints in a way that may cause disruption. 
11. API reports should include request and response samples with sensitive information removed. 

26. AI, Automation, and Business Logic Reports 

If Galla.app includes automation, reports, recommendations, or AI-enabled features, reports may be considered in scope where they create a real security or privacy impact. 

Examples may include: 

1. Unauthorised access through automation. 
2. Data leakage through reports. 
3. Cross-tenant exposure. 
4. Access control bypass in dashboards. 
5. Prompt injection causing data exposure, where applicable. 
6. Automation triggering unauthorised actions. 
7. Business logic flaws causing unauthorised data changes. 

The following are generally out of scope unless clear security impact is shown: 

1. Hallucinated output without data exposure. 
2. Low-quality recommendations. 
3. Business disagreement with automated output. 
4. Generic prompt manipulation with no security impact. 
5. Non-security-related AI behaviour. 

27. Duplicate Reports 

If multiple researchers report the same vulnerability, recognition may be given to the first valid report received with sufficient detail. 

Duplicate reports may not be eligible for recognition. 

Reports about already known issues or issues already under remediation may be closed as duplicates. 

28. Confidentiality 

All vulnerability information must be treated as confidential. 

Researchers must not disclose: 

1. Vulnerability details. 
2. Exploit steps. 
3. Screenshots. 
4. Proof-of-concept code. 
5. Customer data. 
6. Internal URLs. 
7. API tokens. 
8. Credentials. 
9. System details. 
10. Remediation status. 

Confidentiality remains in effect until Treewalker Digital Private Limited gives written permission for disclosure or the vulnerability is otherwise publicly disclosed by us. 

29.  Public Disclosure Approval 

If you wish to publicly disclose a vulnerability after remediation, you must request written approval. 

We may approve disclosure if: 

1. The vulnerability is fixed. 
2. Customer data is not exposed. 
3. Sensitive technical details are removed. 
4. The disclosure does not enable attacks. 
5. The disclosure is accurate. 
6. The disclosure does not include confidential information. 
7. The disclosure timing is mutually agreed. 
8. The disclosure does not violate law, contract, or third-party terms. 

We may deny or delay disclosure for security, privacy, legal, customer, or operational reasons. 

30. Legal Compliance

Researchers are responsible for complying with applicable laws. 

This Policy does not authorise: 

1. Illegal access. 
2. Data theft. 
3. Unauthorised testing. 
4. Malware use. 
5. Service disruption. 
6. Attacks on third-party systems. 
7. Violation of privacy law. 
8. Violation of customer contracts. 
9. Violation of third-party platform terms. 
10. Extortion or coercion. 

Treewalker Digital Private Limited reserves all legal rights against harmful, unlawful, malicious, or policy-violating activity. 

31. Reports from Customers and Employees 

Customers, employees, contractors, partners, and vendors may also report suspected security issues under this Policy. 

Internal employees and contractors should follow internal security reporting channels where available. 

Customers should also contact Support if the issue affects account access, billing, hardware, POS operations, warehouse operations, integrations, or data availability. 

Security reports should be sent to the Security Email. 

32. Reports Involving Third Parties

If your report involves a third-party service, such as WhatsApp/Meta, payment gateway, ecommerce platform, marketplace, cloud provider, ERP, logistics provider, SMS provider, email provider, analytics tool, or customer-owned system, we may not be able to fix the issue directly. 

In such cases, we may: 

1. Validate whether Galla.app is affected. 
2. Work around the issue where feasible. 
3. Notify the third party where appropriate. 
4. Ask you to report directly to the third party. 
5. Coordinate only where we have a contractual or operational relationship. 
6. Close the report if the issue is outside our control. 
7. This Policy does not give permission to test third-party services. 

33.  Enforcement 

If a researcher or user violates this Policy, Treewalker Digital Private Limited may take appropriate action, including: 

1. Requesting immediate stop of testing. 
2. Blocking traffic. 
3. Suspending accounts. 
4. Revoking API keys. 
5. Disabling access. 
6. Preserving evidence. 
7. Notifying affected customers. 
8. Notifying third-party providers. 
9. Reporting to authorities where required. 
10. Taking legal action. 

Good-faith reporting is welcome. Harmful, reckless, unlawful, or extortionate conduct is not. 

34. Policy Updates

Treewalker Digital Private Limited may update this Policy from time to time to reflect: 

1. Product changes. 
2. Security process changes. 
3. Legal or regulatory requirements. 
4. Changes in scope. 
5. Changes in reporting process. 
6. Changes in eligible systems. 
7. Changes in responsible disclosure practices. 
8. Operational or business requirements. 

When we update this Policy, we will revise the “Last Updated” date. 

Continued testing or reporting after the updated Policy becomes effective means that you agree to follow the updated Policy. 

35. Contact information

For security reports and responsible disclosure: 

Treewalker Digital Private Limited
Product: Galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100
Legal Email: legal@treewalkerlabs.com
Support Email: support@treewalkerlabs.com
Phone: +91-6366-740-274
CIN: U72900KA2021PTC153840
GSTIN: 29AAICT9733E1ZX 

36. Related Policies

This Responsible Disclosure Policy should be read together with: 

1. Terms of Service. 
2. Privacy Policy. 
3. Cookie Policy. 
4. Data Processing Addendum. 
5. Subprocessor List. 
6. Acceptable Use Policy. 
7. WhatsApp Marketing Policy. 
8. Security Overview. 
9. SLA and Support Policy. 
10. Data Retention and Deletion Policy. 
11. Incident Response Policy. 
12. Refund, Billing, Cancellation, and Hardware Replacement Policy.