Vulnerability Disclosure

We welcome good-faith security research that helps protect Keisan users and the briefs and estimates they keep with us. This policy explains what is in scope, how to report a finding and what to avoid while testing.

If you follow this policy, make a good-faith effort to avoid privacy violations and do not disrupt the Service, Jishu Labs LLC will not take legal action against you for the research described in your report.

• The public Keisan web application at keisan.jishulabs.com
• Authentication, authorization and account isolation issues
• Exposure of secrets, customer briefs or estimates
• Approval links that reveal more than the one estimate they were made for
• Server-side request handling, API validation and data access control issues
• Cross-site scripting, cross-site request forgery and injection vulnerabilities

• Denial-of-service testing, load testing or resource exhaustion
• Social engineering, phishing or physical attacks
• Reports based only on missing security headers without a practical exploit
• Automated scanner output without analysis or a reproducible impact
• Issues in third-party services that do not affect Keisan directly

Send reports to admin@jishulabs.com with a subject that starts with “Security”, or through the contact page. Include enough detail for us to reproduce the issue:

• The affected URL, endpoint or feature
• Steps to reproduce, a proof of concept and the expected impact
• The account email used for testing, if any
• Any logs, screenshots or timestamps that help confirm the issue

We will confirm that we received your report, assess it by severity and keep you updated as we fix it. Please wait to disclose publicly until we have confirmed and fixed the issue, unless we agree otherwise in writing.