Security at Duvaxa

Report a security problem

If you find a vulnerability in this website or in any Duvaxa tool, email deepanshu.saini@duvaxa.com with the subject "Security report". Include what you found, how to reproduce it and what an attacker could do with it. Please don't include real customer data.

What happens next

We acknowledge reports within 3 working days, tell you whether we can reproduce the problem, and keep you updated until it is fixed. With your permission we credit you once the fix is released.

Good-faith research

We won't take legal action against research done in good faith: test only against your own accounts and data, don't degrade the service, don't access or keep other people's data, and give us reasonable time to fix the problem before you publish it.

Out of scope

Denial-of-service and load testing, spam or social engineering of our staff, physical attacks, and reports that only list missing best-practice headers without a working impact.

How our tools handle your data

Our command-line tools run on your own machine or in your own CI. They read the files, exports or read-only APIs you point them at and write reports locally; they don't send your data to Duvaxa. Licence keys are checked offline. Hosted services such as ProspectFit keep each customer's data in its own workspace.

This website

No analytics, ads or tracking cookies. Pages are served over HTTPS only, with a strict Content-Security-Policy that lets only our own scripts run. Our machine-readable contact is at /.well-known/security.txt.

Last updated: 24 October 2026.