COGNIVIA — RESPONSIBLE DISCLOSURE POLICY
========================================

Cognivia is an education-research platform that stores longitudinal learning
data on students, many of them minors. We take adversarial use seriously and
welcome reports from security researchers.

IF YOU FIND A VULNERABILITY
---------------------------
Email manikmaurya.in@gmail.com with:
  - what you found and where (URL / endpoint / parameter),
  - the steps to reproduce it,
  - the impact you believe it has.

Please report privately and give us a reasonable chance to fix it before any
public disclosure. We will acknowledge within 3 business days.

SAFE HARBOUR
------------
We will not pursue or support legal action against researchers who, in good
faith, follow this policy: test only against your own test accounts, avoid
privacy violations and service degradation, never access or modify another
user's data, and stop as soon as you have demonstrated a problem.

IN SCOPE
--------
  - cognivia-platform.vercel.app and its /api/* backend
  - the authentication / signup flow
  - anything exposing participant data

OUT OF SCOPE
------------
  - social engineering, physical attacks, and spam/DoS
  - automated scanner output with no demonstrated impact
  - findings that require a rooted device or a compromised third-party account

REWARDS
-------
We do not run a paid bug-bounty yet. We will publicly credit any reporter who
wants recognition, and we prioritise fixes for anything touching minors' data.

Thank you for helping keep students' data safe.