Responsible disclosure
Reporting a security problem
If you find a weakness in the NPPA website, please tell us privately so we can fix it before anyone misuses it. We welcome reports from members, students and security researchers.
Reply within 5 working days
No legal action for good-faith research
Hall of Fame
How to report
Send us the details
Email admin@nppassociation.org with the subject “Security report”.
- What you found and which page or address it is on.
- How to see it again: the steps, and a screenshot or short video if you can.
- What someone could do with it, in your view.
- How to reach you, and the name you would like on our Hall of Fame (or tell us to keep you anonymous).
The rules
Please test safely
Please do
- Use only your own NPPA account, or a test account you create.
- Stop as soon as you have shown the problem exists.
- Give us reasonable time to fix it before telling anyone else.
- Delete any personal data you came across, and tell us you did.
Please don’t
- Access, change or download other members’ data.
- Slow down or overload the website (no denial-of-service tests, no automated scanning at high speed).
- Send spam, phishing or social-engineering messages to members, NPPA staff or our partners.
- Test Razorpay, Google, Cloudflare or HostGator themselves: report those to the company concerned.
What is covered
In scope and out of scope
In scope
- nppassociation.org and its pages: sign-up, login, My NPPA, the Members List, payments and receipts, the Privacy Centre.
- Ways to see or change someone else’s data, sign in as someone else, or run code on the website.
Usually not accepted
- Reports from automated scanners without a working example.
- Missing best-practice settings with no real effect (for example a header on a page with no sensitive content).
- Problems that need a stolen device, a hacked email account or an outdated browser.
- Rate limits on non-sensitive actions, and clickjacking on pages with nothing to click.
Our promise
What you can expect from us
A quick reply
We confirm your report within 5 working days and keep you updated until it is fixed.
Safe harbour
If you follow these rules in good faith, NPPA will not take legal action against you or report you to the authorities for your research.
Recognition
NPPA is a not-for-profit association and does not pay bounties. Valid reports are thanked on our Hall of Fame below, with your permission.
Hall of Fame
With thanks to the people who have helped keep NPPA members safe.
- Be the first: your name could be here.
