1. Infrastructure Security Controls
ZoraGram implements multi-layered defensive controls to safeguard user communications, identity records, and application availability:
- End-to-End Transit Encryption: All traffic between the ZoraGram Android app, client browsers, and API endpoints is encrypted using modern Transport Layer Security (TLS 1.2+ / TLS 1.3). Plaintext HTTP connections are strictly prohibited.
- Credential Protection: User passwords are never stored in readable format. Passwords are salted and cryptographically hashed using industry-standard hashing algorithms (bcrypt / Argon2).
- Session Security: API authorization tokens and web session identifiers use cryptographically randomized generators with strict expiration windows and secure, HttpOnly flags.
- Injection Defenses: All database queries and API endpoints utilize parameterized statements and prepared queries to neutralize SQL Injection, XSS, and command injection vectors.
2. Responsible Vulnerability Disclosure
We welcome collaboration with independent security researchers, ethical hackers, and academic investigators who assist in identifying and remediating system vulnerabilities prior to public exploitation.
We are committed to addressing valid vulnerability submissions with urgency, transparency, and respect for researchers' efforts.
3. Scope of Security Research
The following targets are In-Scope for coordinated testing:
- ZoraGram Android mobile application (Package:
com.zoragram.friendship). - Production API endpoints directly serving the mobile application.
- Official web domain infrastructure (
zoragram.in).
The following testing behaviors are Out-of-Scope and Strictly Prohibited:
- Denial of Service (DoS/DDoS) attacks against servers, gateways, or load balancers.
- Accessing, modifying, exfiltrating, or deleting real user data or private direct messages.
- Social engineering, spear-phishing, or physical intrusion into employee or server facilities.
- Spamming contact forms, SMS gateways, or third-party ad networks.
4. Safe Harbor for Ethical Researchers
If you conduct vulnerability research in good faith accordance with this policy:
- We will not initiate civil lawsuits or pursue criminal complaints against you under the Computer Fraud and Abuse Act, IT Act 2000, or relevant cybersecurity statutes.
- We consider your research to be authorized conduct.
- We will work collaboratively with you to validate the issue, provide engineering updates, and publicly acknowledge your discovery upon patch deployment (with your consent).
5. How to Submit a Vulnerability Report
If you have discovered a security flaw, please email our engineering security desk at support@zoragram.in or use our Security / Bug Submission Form:
- Provide detailed technical steps to reproduce the vulnerability (including HTTP request/response transcripts, endpoints, and affected parameters).
- Provide a proof of concept demonstrating the security impact without harming live data.
- Allow our engineering team a reasonable window (typically 30 to 90 days depending on severity) to remediate before public disclosure.
SLA: We acknowledge receipt of valid security reports within 48 hours and provide triage status updates within 5 business days.
6. User Account Security Hygiene
We encourage all ZoraGram users to observe essential account safety practices:
- Use a unique, high-entropy password not shared across other websites.
- Never share your password or verification codes with anyone, including individuals claiming to represent ZoraGram staff.
- Always keep the ZoraGram Android app updated to the latest version available on Google Play to ensure you have the latest security patches.