Bug Bounty

Responsible Vulnerability Disclosure & Bug Bounty Program

CakeLelo values the security research community. If you discover a security vulnerability in our web applications, APIs, or infrastructure, we appreciate your help in disclosing it to us responsibly.

1. Scope - **In Scope:** https://cakelelo.com, Admin Portal APIs, Authentication mechanisms, Order & Payment integrity workflows, POS counter shift APIs. - **Out of Scope:** Third-party payment gateways (Razorpay), Denial of Service (DoS/DDoS) attacks, automated high-frequency scanning without prior written approval.

2. Disclosure Guidelines - Give us reasonable time (minimum 48 hours) to investigate and mitigate the reported vulnerability before public disclosure. - Do not exploit the vulnerability to access, modify, or destroy customer or business records. - Submit reports with clear reproduction steps and Proof of Concept (PoC) to **security@cakelelo.com**.

3. Recognition & Rewards Valid security reports that prevent data compromise, price tampering, or privilege escalation are eligible for CakeLelo Hall of Fame listing and cash bounties ranging from ₹2,500 to ₹50,000 based on severity (CVSS score).